vmspawn: Run with sandbox

Now that we can look up binaries in --extra-search-paths=, we can run
vmspawn with a sandbox as well.

diff --git a/mkosi/vmspawn.py b/mkosi/vmspawn.py
index 3bab311c1a762307b84785b1f391d0665747f10f..9bc0027c68f42569f11c601acf9ad6feb88c136d 100644 (file)
--- a/mkosi/vmspawn.py
+++ b/mkosi/vmspawn.py
@@ -102,4 +102,11 @@ def run_vmspawn(args: Args, config: Config) -> None:
 
         cmdline += [*args.cmdline, *config.kernel_command_line_extra]
 
-        run(cmdline, stdin=sys.stdin, stdout=sys.stdout, env=os.environ | config.environment, log=False)
+        run(
+            cmdline,
+            stdin=sys.stdin,
+            stdout=sys.stdout,
+            env=os.environ | config.environment,
+            log=False,
+            sandbox=config.sandbox(binary=cmdline[0], network=True, devices=True, relaxed=True),
+        )