i3-config/bwrap/ungoogled-chromium-private.bash

#!/bin/bash

set -euo pipefail

(exec bwrap \
      --proc /proc \
      --dev /dev \
      --tmpfs /tmp \
      --dev-bind /dev/dri /dev/dri \
      --dev-bind /dev/snd /dev/snd \
      --ro-bind /etc/fonts/ /etc/fonts/ \
      --ro-bind /etc/sndio.conf /etc/sndio.conf \
      --ro-bind /etc/ssl/certs /etc/ssl/certs \
      --ro-bind /etc/resolv.conf /etc/resolv.conf \
      --ro-bind /lib /lib \
      --ro-bind /lib64 /lib64 \
      --ro-bind /sys/dev/char /sys/dev/char \
      --ro-bind /sys/devices /sys/devices \
      --ro-bind /usr/bin /usr/bin \
      --ro-bind /usr/include/fontconfig /usr/include/fontconfig \
      --ro-bind /usr/lib /usr/lib \
      --ro-bind /usr/lib64 /usr/lib64 \
      --ro-bind /usr/share/alsa /usr/share/alsa \
      --ro-bind /usr/share/applications /usr/share/applications \
      --ro-bind /usr/share/ca-certificates /usr/share/ca-certificates \
      --ro-bind /usr/share/fonts /usr/share/fonts \
      --ro-bind /usr/share/glib-2.0 /usr/share/glib-2.0 \
      --ro-bind /usr/share/icons /usr/share/icons \
      --ro-bind /usr/share/libdrm /usr/share/libdrm \
      --ro-bind /usr/share/mime /usr/share/mime \
      --ro-bind /usr/share/X11/xkb /usr/share/X11/xkb \
      --ro-bind /var/cache/fontconfig /var/cache/fontconfig \
      --ro-bind /var/lib/alsa /var/lib/alsa \
      --ro-bind /var/guix /var/guix \
      --ro-bind /gnu/store/ /gnu/store \
      --bind-try /tmp/sndio /tmp/sndio \
      --bind-try /tmp/sndio-"$(id -u)" /tmp/sndio-"$(id -u)" \
      --bind-try "${HOME}/.sndio" "${HOME}/.sndio" \
      --bind "${HOME}/.guix-profile" "${HOME}/.guix-profile" \
      --bind "$(xdg-user-dir DOWNLOAD)" "$(xdg-user-dir DOWNLOAD)" \
      --chdir "${HOME}" \
      --unshare-all \
      --share-net \
      --die-with-parent \
      --hostname RESTRICTED \
      --setenv SHELL /bin/false \
      --setenv PATH $HOME/.guix-profile/bin:/usr/bin:/bin \
      --file 11 /etc/passwd \
      --file 12 /etc/group \
      --new-session \
      $HOME/.guix-profile/bin/chromium) \
    11< <(getent passwd $UID 65534 audio video) \
    12< <(getent group "$(id -g)" 65534 audio video)

# note: running ungoogled-chromium (GNU Guix) on private mode sanbox