4 ms·
First problem is that proper (incl. X11...) isolation costs you 3D (so not great for Firefox). Otherwise there is "toolbox" by Fedora, which you could surely co
by fock 5y ago
First problem is that proper (incl. X11...) isolation costs you 3D (so not great for Firefox). Otherwise there is "toolbox" by Fedora, which you could surely combine with Xephyr for a wine-like, more isolated experience. I do that with a shell-only workflow (though on my HiDPI-machines I still have to patch Xephyr to scale the output (which is pretty easy using its GL-backend tbh, but I need to refine my amateur C dabblings to release that).
EDIT: I'm happy to discuss how to use Wayland with proper isolation and 3D! (and some frame-decoration)
- rosetremiere 5y agoI didn't know about "toolbox": it seems close to what I want. About 3D, does calling a program through `bwrap` disable opengl or something?
- fock 5y agowell, depending on what you do, you usually need access to the dri-device, the X11-driver and X11 (socket). This is relatively insecure I suppose because it exposes a giant attack-surface. Everything trying to mitigate this (short of running VNC) unfortunately still has some, but I would expect noone targets these broad-spectrum. An interesting thing to do would be to run with VGL and a quadro/...-GPU which allows partitioning into different rendering devices. Haven't tried reading about this with wayland.
- PausGreat 5y ago> Xephyr It's easier to use Wayland. Additionally, Toolbox does not sandbox the application.
- fock 5y agoThen how will wayland tell me, which container a window comes from? (besides that, most software I use in containers is very much preeee-wayland). Thanks for the correction on toolbox, I know remember again, why I have my own bwrap-wrapper.