3 files changed, 24 insertions, 3 deletions
diff --git a/scripts/dot-local/bin/alanvim b/scripts/dot-local/bin/alanvim
deleted file mode 100755
index 5262939..0000000
--- a/scripts/dot-local/bin/alanvim
+++ /dev/null
@@ -1,3 +0,0 @@
-#!/bin/sh
-
-exec runapp -- alacritty -e nvim "$@"
diff --git a/scripts/dot-local/bin/launch-chromium b/scripts/dot-local/bin/launch-chromium
new file mode 100755
index 0000000..1128ac5
--- /dev/null
+++ b/scripts/dot-local/bin/launch-chromium
@@ -0,0 +1,3 @@
+#!/bin/sh
+
+exec /usr/bin/chromium --disk-cache-dir="$XDG_RUNTIME_DIR/chromium-cache" "$@"
diff --git a/scripts/dot-local/bin/safe_extract b/scripts/dot-local/bin/safe_extract
new file mode 100755
index 0000000..0574816
--- /dev/null
+++ b/scripts/dot-local/bin/safe_extract
@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+(
+    exec bwrap \
+     --ro-bind /usr/bin /usr/bin/ \
+     --ro-bind /usr/share /usr/share \
+     --ro-bind /usr/lib /usr/lib \
+     --ro-bind /usr/lib64 /usr/lib64 \
+     --symlink /usr/lib64 /lib64 \
+     --symlink /usr/lib /lib \
+     --symlink /usr/bin /bin \
+     --symlink /usr/bin /sbin \
+     --proc /proc \
+     --dev /dev \
+     --bind "$PWD" "$PWD" \
+     --unshare-all \
+     --new-session \
+     --seccomp 10 \
+     /usr/bin/ouch decompress "$@"
+)