{
  pkgs,
  runtime,
  executable,
}:
let
  closure = pkgs.closureInfo { rootPaths = [ runtime ]; };
  filter =
    pkgs.runCommand "quixos-restricted-seccomp"
      {
        nativeBuildInputs = [
          pkgs.stdenv.cc
          pkgs.pkg-config
        ];
        buildInputs = [ pkgs.libseccomp ];
      }
      ''
        $CC -O2 -Wall -Wextra -Werror ${./seccomp.c} $(pkg-config --cflags --libs libseccomp) -o filter
        ./filter > "$out"
      '';
in
pkgs.runCommand "quixos-restricted-sandbox" { nativeBuildInputs = [ pkgs.stdenv.cc ]; } ''
  mkdir -p "$out/bin"
  $CC -O2 -Wall -Wextra -Werror ${./sandbox.c} \
    -DSANDBOX_BWRAP='"${pkgs.bubblewrap}/bin/bwrap"' \
    -DSANDBOX_EXECUTABLE='"${executable}"' \
    -DSANDBOX_FILTER='"${filter}"' \
    -DSANDBOX_CLOSURE='"${closure}/store-paths"' \
    -o "$out/bin/quixos-restricted-sandbox"
''