Sandboxed cargo and rust-analyzer

cargo-secure

#!/usr/bin/env bash
#
#  cargo-secure
#
#  Sandboxed version of cargo to calm my mind.
#  Adjust to your liking
#

set -eu -o pipefail

bwrap \
  --die-with-parent \
  --new-session \
  --unshare-ipc \
  --unshare-pid \
  --tmpfs / \
  --tmpfs /run \
  --dir /tmp \
  --dev /dev \
  --proc /proc \
  --ro-bind /var /var \
  --ro-bind /usr /usr \
  --symlink usr/bin /bin \
  --symlink usr/sbin /sbin \
  --ro-bind /etc /etc \
  --symlink usr/lib /lib \
  --symlink usr/lib64 /lib64 \
  --ro-bind "$HOME/bin" "$HOME/bin" \
  --ro-bind "$HOME/.gitconfig" "$HOME/.gitconfig" \
  --ro-bind "$HOME/.work.gitconfig" "$HOME/.work.gitconfig" \
  --bind "$HOME/.cache" "$HOME/.cache" \
  --bind "$HOME/.cargo" "$HOME/.cargo" \
  --bind "$HOME/.rustup" "$HOME/.rustup" \
  --bind "$(pwd)" "$(pwd)" \
  -- \
  cargo "$@"

rust-analyzer-secure

#!/usr/bin/env bash
#
#  rust-analyzer-secure
#
#  Sandboxed version of rust-analyzer to calm my mind.
#  Adjust to your liking
#

set -eu -o pipefail

bwrap \
  --die-with-parent \
  --new-session \
  --unshare-ipc \
  --unshare-pid \
  --tmpfs / \
  --tmpfs /run \
  --dir /tmp \
  --dev /dev \
  --proc /proc \
  --ro-bind /var /var \
  --ro-bind /usr /usr \
  --symlink usr/bin /bin \
  --symlink usr/sbin /sbin \
  --ro-bind /etc /etc \
  --symlink usr/lib /lib \
  --symlink usr/lib64 /lib64 \
  --ro-bind "$HOME/bin" "$HOME/bin" \
  --ro-bind "$HOME/.gitconfig" "$HOME/.gitconfig" \
  --ro-bind "$HOME/.work.gitconfig" "$HOME/.work.gitconfig" \
  --bind "$HOME/.cache" "$HOME/.cache" \
  --bind "$HOME/.cargo" "$HOME/.cargo" \
  --bind "$HOME/.rustup" "$HOME/.rustup" \
  --bind "$(pwd)" "$(pwd)" \
  -- \
  rust-analyzer "$@"