bwrap-cwd.bash

gistfile1.txt

#!/bin/bash
set -euo pipefail

if [ $# -eq 0 ]; then
  echo "Usage: $(basename "$0") <command> [args...]" >&2
  exit 1
fi

# ── Read-only paths to expose under $HOME ──
# Add or remove entries as needed
RO_HOME_PATHS=(
  .local/bin
  .local/share
  .config/git
  .gitconfig
  .bashrc
  .profile
)

# ── Read-write paths under $HOME ──
RW_HOME_PATHS=(
  .claude
  .claude.json
  .config/claude
)

# ── Build bwrap args ──
args=(
  --ro-bind / /
  --tmpfs "$HOME"
  --ro-bind /var/other-code-resource /var/other-code-resource
  --bind "$(pwd)" "$(pwd)"
  --dev /dev
  --proc /proc
  --tmpfs /tmp
  --unshare-all
  --share-net
  --die-with-parent
)

for p in "${RO_HOME_PATHS[@]}"; do
  src="$HOME/$p"
  [ -e "$src" ] && args+=(--ro-bind "$src" "$src")
done

for p in "${RW_HOME_PATHS[@]}"; do
  src="$HOME/$p"
  [ -e "$src" ] && args+=(--bind "$src" "$src")
done

exec bwrap "${args[@]}" -- "$@"