Skip to content
Snippets Groups Projects
  1. Apr 08, 2020
    • Simon McVittie's avatar
      wrap: Add the ability to unshare the pid namespace · feb948ed
      Simon McVittie authored
      This improves isolation between the host system and the game, and can
      be used in conjunction with bwrap's init/reaper process to make game
      termination fully reliable (unlike subreapers, killing the init process
      automatically kills the entire pid namespace).
      
      One major down-side of doing this is that if the game uses
      process-ID-oriented APIs, for example older versions of
      <https://github.com/FeralInteractive/gamemode
      
      >, then they will not
      work, because the process ID inside the container is not the same as
      the process ID outside the container.
      
      Unfortunately, Steam's own tracking of the processes that belong to a game
      is one of the process-ID-oriented APIs that this harms, so this branch
      does not unshare the pid namespace by default, only when requested. We
      can use this to test whether it can be done without breaking Steam;
      We will probably need to cope with separate pid namespaces if we create
      new containers from inside a Flatpak environment.
      
      Also add an option to unload the gameoverlayrenderer.so module, which
      is not acceptable for production use, but at least works around this
      well enough to unblock further testing.
      
      Signed-off-by: default avatarSimon McVittie <smcv@collabora.com>
      feb948ed
  2. Mar 24, 2020
  3. Mar 23, 2020
  4. Mar 18, 2020
  5. Mar 04, 2020
  6. Feb 26, 2020
  7. Feb 17, 2020
  8. Feb 10, 2020
  9. Feb 03, 2020
  10. Jan 23, 2020
  11. Jan 06, 2020
  12. Dec 13, 2019
    • Simon McVittie's avatar
      wrap: Mount pressure-vessel on /run/pressure-vessel if using runtime · 596e50ad
      Simon McVittie authored
      When we're using a non-trivial runtime, we need to make
      pressure-vessel-with-lock available to the container.
      
      Previously, if your pressure-vessel installation was visible via your
      home directory (if shared), via $(realpath ~/.steam/steam), or via the
      current working directory at the time of running pressure-vessel-wrap,
      then it would exist in the container at the same path as outside the
      container, so this would work. However, if you have installed it in
      an alternative Steam library such as /media/big/library, none of these
      mount points would make it visible and bwrap would fail to run it.
      
      Circumvent this by mounting the relocatable pressure-vessel prefix
      on /run/pressure-vessel, which lets us run it via that path.
      
      Bug: https://github.com/ValveSoftware/steam-runtime/issues/204
      
      
      Signed-off-by: default avatarSimon McVittie <smcv@collabora.com>
      596e50ad
  13. Nov 14, 2019
Loading