1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
| | #!/bin/execlineb -P
# SPDX-License-Identifier: EUPL-1.2+
# SPDX-FileCopyrightText: 2025 Alyssa Ross <hi@alyssa.is>
# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>
s6-ipcserver -1a 0700 -c 1 -b 1 env/crosvm.sock
importas -Si WAYLAND_DISPLAY
bwrap
--unshare-all
# --unshare-all only implies --unshare-user-try.
# Make this more than a "try".
--unshare-user
--bind $WAYLAND_DISPLAY $WAYLAND_DISPLAY
--ro-bind /usr /usr
--ro-bind /lib /lib
--tmpfs /tmp
--dev /dev
--tmpfs /dev/shm
--ro-bind /nix /nix
--disable-userns
--proc /proc
--ro-bind /proc/sys /proc/sys
--tmpfs /proc/scsi
--remount-ro /proc/scsi
--tmpfs /proc/acpi
--remount-ro /proc/acpi
--tmpfs /proc/fs
--remount-ro /proc/fs
--tmpfs /proc/irq
--remount-ro /proc/irq
--ro-bind /dev/null /proc/timer_list
--ro-bind /dev/null /proc/kcore
--ro-bind /dev/null /proc/kallsyms
--ro-bind /dev/null /proc/sysrq-trigger
--
crosvm --no-syslog device gpu
--fd 0
--wayland-sock $WAYLAND_DISPLAY
--params "{\"context-types\":\"cross-domain\"}"
|