default.nix

let
  pkgs = import (fetchTarball channel:nixos-18.03) {};
  custom-store = "/home/freddy/nix_custom_store";
  # Run nix in a mount namespace
  nix-wrapped = pkgs.writeShellScriptBin "nix" ''
    ${pkgs.bubblewrap}/bin/bwrap \
      --unshare-all \
      --proc /proc \
      --dev /dev \
      --tmpfs /run \
      --bind /nix /nix \
      --bind /home /home \
      --setenv NIX_DAEMON "" \
      --setenv NIX_STORE_DIR ${custom-store}/nix/store \
      --setenv NIX_STATE_DIR ${custom-store}/nix/var \
      --setenv NIX_SSL_CERT_FILE ${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt \
      ${pkgs.nix}/bin/nix $@
  '';
  nix-wrapped-bundled = pkgs.runCommand "nix-bundled" {} ''
    ${pkgs.nix-bundle}/bin/nix-bundle ${nix-wrapped} /bin/nix
    mkdir -p $out
    mv nix $out/
  '';
in nix-wrapped