In reply to @kraftnix:matrix.org
Hey all, I have a quick question about the state of gaming on NixOS. How well are the games + steam isolated from the rest of your desktop? Are they bubblewrapped, apparmored or chrooted? I like to game on my main workstation (as its my most powerful machine), so isolation is quite important for me, for now I've just been running a windows VM with passthrough, but I'd rather move fully to native Linux if possible.

sorry for long paste

cmd=(
  /nix/store/zri5czxwi0gmipi8mxc2j5samg39ncdl-bubblewrap-0.4.1/bin/bwrap
  --dev-bind /dev /dev
  --proc /proc
  --chdir "$(pwd)"
  --unshare-user
  
  
  
  --unshare-uts
  --unshare-cgroup
  --die-with-parent
  --ro-bind /nix /nix
  # Our glibc will look for the cache in its own path in `/nix/store`.
  # As such, we need a cache to exist there, because pressure-vessel
  # depends on the existence of an ld cache. However, adding one
  # globally proved to be a bad idea (see #100655), the solution we
  # settled on being mounting one via bwrap.
  # Also, the cache needs to go to both 32 and 64 bit glibcs, for games
  # of both architectures to work.
  --tmpfs /nix/store/sbbifs2ykc05inws26203h0xwcadnf0l-glibc-2.32-46/etc \
  --symlink /etc/ld.so.conf /nix/store/sbbifs2ykc05inws26203h0xwcadnf0l-glibc-2.32-46/etc/ld.so.conf \
  --symlink /etc/ld.so.cache /nix/store/sbbifs2ykc05inws26203h0xwcadnf0l-glibc-2.32-46/etc/ld.so.cache \
  --ro-bind /nix/store/sbbifs2ykc05inws26203h0xwcadnf0l-glibc-2.32-46/etc/rpc /nix/store/sbbifs2ykc05inws26203h0xwcadnf0l-glibc-2.32-46/etc/rpc \
  --remount-ro /nix/store/sbbifs2ykc05inws26203h0xwcadnf0l-glibc-2.32-46/etc \
  --tmpfs /nix/store/yq8af95fn63gzg43npg4wj9kwq37dd28-glibc-2.32-46/etc \
  --symlink /etc/ld.so.conf /nix/store/yq8af95fn63gzg43npg4wj9kwq37dd28-glibc-2.32-46/etc/ld.so.conf \
  --symlink /etc/ld.so.cache /nix/store/yq8af95fn63gzg43npg4wj9kwq37dd28-glibc-2.32-46/etc/ld.so.cache \
  --ro-bind /nix/store/yq8af95fn63gzg43npg4wj9kwq37dd28-glibc-2.32-46/etc/rpc /nix/store/yq8af95fn63gzg43npg4wj9kwq37dd28-glibc-2.32-46/etc/rpc \
  --remount-ro /nix/store/yq8af95fn63gzg43npg4wj9kwq37dd28-glibc-2.32-46/etc \
  --ro-bind-try /etc/static /etc/static
  --ro-bind-try /etc/nix /etc/nix
  --ro-bind-try /etc/bashrc /etc/bashrc
  --ro-bind-try /etc/zshenv /etc/zshenv
  --ro-bind-try /etc/zshrc /etc/zshrc
  --ro-bind-try /etc/zinputrc /etc/zinputrc
  --ro-bind-try /etc/zprofile /etc/zprofile
  --ro-bind-try /etc/passwd /etc/passwd
  --ro-bind-try /etc/group /etc/group
  --ro-bind-try /etc/shadow /etc/shadow
  --ro-bind-try /etc/hosts /etc/hosts
  --ro-bind-try /etc/resolv.conf /etc/resolv.conf
  --ro-bind-try /etc/nsswitch.conf /etc/nsswitch.conf
  --ro-bind-try /etc/profiles /etc/profiles
  --ro-bind-try /etc/login.defs /etc/login.defs
  --ro-bind-try /etc/sudoers /etc/sudoers
  --ro-bind-try /etc/sudoers.d /etc/sudoers.d
  --ro-bind-try /etc/localtime /etc/localtime
  --ro-bind-try /etc/zoneinfo /etc/zoneinfo
  --ro-bind-try /etc/machine-id /etc/machine-id
  --ro-bind-try /etc/os-release /etc/os-release
  --ro-bind-try /etc/pam.d /etc/pam.d
  --ro-bind-try /etc/fonts /etc/fonts
  --ro-bind-try /etc/asound.conf /etc/asound.conf
  --ro-bind-try /etc/ssl/certs /etc/ssl/certs
  --ro-bind-try /etc/pki /etc/pki
  "${ro_mounts[@]}"
  "${symlinks[@]}"
  "${auto_mounts[@]}"
  /nix/store/ibg4am7f75lvzy1hn980v13hd2fy59xz-steam-init/bin/steam-init "$@"
)
exec "${cmd[@]}"

In reply to @kity:kity.wtf
the intent is not for sandboxing though, it's just to get steam to work