Empty mount source for "ro" section results in mounting everything read-only

[corpix]

{
  "mounts": {
    "rw": [
      "~/code",
      "~/dotfiles",
      "~/.emacs.d",
      "~/.cache/emacs",
      "~/.cache",
      "~/.config",
      "~/.local",
      "/tmp"
    ],
    "ro": [
      "$XAUTHORITY",
      "~/.ssh",
      "~/.gitconfig",
      "/"
    ],
    "tmpfs": [
      "/tmp",
      "/home",
      "/run/user",
      "/run/user/$UID"
    ]
  },
  "environment": {
     "SHELL": "$SHELL",
     "NIX_REMOTE": "daemon",
     "DISPLAY": "$DISPLAY"
  },
  "arguments": {
    "mode": "replace",
    "bwrap": [
      "--die-with-parent"
    ]
  }
}

Reproducible when XAUTHORITY is empty or unset

[coderofsalvation]

is nix-cage.json a place to configure the cage? (I didn't really understand this from the documentation)

[corpix]

@coderofsalvation yes