3 ms·
>However, this is limited to Xorg (which is fine for most applications), however there is growing native support for Wayland. The principle of nesting Xephyr i
by Arnavion 5y ago
>However, this is limited to Xorg (which is fine for most applications), however there is growing native support for Wayland.
The principle of nesting Xephyr inside the host X server easily extends to nesting cage or sway or weston inside the host's wayland compositor.
- lavabiopsy 5y agoFor certain Wayland implementations (GNOME) that is not necessary, as there are no privileged interfaces that are exposed over wayland. The privileged interfaces are part of the flatpak portal which are filtered using a d-bus proxy. The biggest security worry you might have there is the GPU, which you need to expose to the sandbox if you want to run modern apps and games, etc. I don't know about other implementations, they could be doing other bad things over the wayland socket which break the flatpak and snap security.