3 ms·
While I think it is great to explore using containers for isolate desktop apps, that is my understanding of what tools like Flatpak and snapd does already. I'd
by encryptluks2 5y ago
While I think it is great to explore using containers for isolate desktop apps, that is my understanding of what tools like Flatpak and snapd does already. I'd love to see them implemented into the standard container ecosystem though. However, this is limited to Xorg (which is fine for most applications), however there is growing native support for Wayland.
- Arnavion 5y ago>However, this is limited to Xorg (which is fine for most applications), however there is growing native support for Wayland. The principle of nesting Xephyr inside the host X server easily extends to nesting cage or sway or weston inside the host's wayland compositor.
- lavabiopsy 5y agoFor certain Wayland implementations (GNOME) that is not necessary, as there are no privileged interfaces that are exposed over wayland. The privileged interfaces are part of the flatpak portal which are filtered using a d-bus proxy. The biggest security worry you might have there is the GPU, which you need to expose to the sandbox if you want to run modern apps and games, etc. I don't know about other implementations, they could be doing other bad things over the wayland socket which break the flatpak and snap security.
- mviereck 5y agox11docker supports Wayland, too. It can directly pass Wayland access from host to containers, or run containered Wayland applications on host X using a nested Weston window. With the help of xpra it can run X application in container on a pure Wayland host.