vars+facts: use bwrap only if supported

pkgs/clan-cli/clan_cli/bwrap/__init__.py

@@ -0,0 +1,42 @@
+from clan_cli.cmd import run
+from clan_cli.nix import nix_shell
+
+_works: bool | None = None
+
+
+def bubblewrap_works() -> bool:
+    global _works
+    if _works is None:
+        _works = _bubblewrap_works()
+    return _works
+
+
+def _bubblewrap_works() -> bool:
+    # fmt: off
+    cmd = nix_shell(
+        [
+            "nixpkgs#bash",
+            "nixpkgs#bubblewrap",
+        ],
+        [
+            "bwrap",
+            "--unshare-all",
+            "--tmpfs",  "/",
+            "--ro-bind", "/nix/store", "/nix/store",
+            "--dev", "/dev",
+            "--chdir", "/",
+            "--bind", "/proc", "/proc",
+            "--uid", "1000",
+            "--gid", "1000",
+            "--",
+            # do nothing, just test if bash executes
+            "bash", "-c", ":"
+        ],
+    )
+    # fmt: on
+    try:
+        run(cmd)
+    except Exception:
+        return False
+    else:
+        return True

pkgs/clan-cli/clan_cli/bwrap/tests/test_bwrap.py

@@ -0,0 +1,16 @@
+import sys
+
+import pytest
+from clan_cli.bwrap import bubblewrap_works
+
+
+@pytest.mark.skipif(sys.platform != "linux", reason="bubblewrap only works on linux")
+def test_bubblewrap_works_on_linux() -> None:
+    assert bubblewrap_works() is True
+
+
+@pytest.mark.skipif(
+    sys.platform == "linux", reason="bubblewrap does not work on non-linux"
+)
+def test_bubblewrap_detection_non_linux() -> None:
+    assert bubblewrap_works() is False