1 files changed, 21 insertions, 0 deletions
diff --git a/sandboxed-discocaml.sh b/sandboxed-discocaml.sh
new file mode 100755
index 0000000..04bd744
--- /dev/null
+++ b/sandboxed-discocaml.sh
@@ -0,0 +1,21 @@
+#!/bin/sh
+set -eu
+
+tmp=$(mktemp)
+cleanup()
+{
+	if [ -e "$tmp" ]; then
+		rm "$tmp"
+	fi
+}
+trap cleanup EXIT
+
+rm "$tmp"
+nix build -o "$tmp" .#discocaml
+bindir="$(realpath "$tmp")/bin"
+
+exec \
+timeout 10 \
+env -i \
+"$(which bwrap)" --unshare-all --ro-bind "$bindir" "/" \
+"/discocaml" "$@"