Skip to content

pv-wrap: Don't make XDG_CONFIG_DIRS, XDG_DATA_DIRS available in container

Simon McVittie requested to merge wip/task493-only-rw into main

Unlike XDG_CONFIG_HOME and XDG_DATA_HOME, these search paths are expected to be read-only, making it much less likely that a game or app component will misbehave if they contain a dangling symlink.

Also unlike XDG_CONFIG_HOME and XDG_DATA_HOME, these paths are much more likely to contain OS-related path elements that can cause container runtime regressions, such as /var/cache (steamrt/tasks#434) and /var/lib (steamrt/tasks#493).

A regression risk with this change is that if a user has set for example XDG_DATA_DIRS=/offload/data:/usr/local/share:/usr/share, since 0.20240301.0 the result has been that /offload/data has been shared with the container, which means apps and games in a SLR container will load icons, .desktop files, etc. from that location. No longer doing this is both good and bad. It's good because it makes the container more self-contained again, but it's bad because users might have come to rely on /offload/data being available, which would no longer be the case after this change.

steamrt/tasks#493


/cc @refi64 @denittis

Ready for review, but needs some thought about whether the risk of additional regressions similar to steamrt/tasks#434, steamrt/tasks#493 outweighs the risk that a user has come to rely on their XDG_CONFIG_DIRS and XDG_DATA_DIRS getting into the container, and as a result encounters a regression as a result of this change.

Merge request reports