#!/bin/execlineb -WP
# SPDX-License-Identifier: EUPL-1.2+
# SPDX-FileCopyrightText: 2025 Alyssa Ross <hi@alyssa.is>
# SPDX-FileCopyrightText: 2025 Demi Marie Obenour <demiobenour@gmail.com>

cgroup-setup --leaf vhost-user-gpu

s6-ipcserver-socketbinder -a 0700 -b 1 env/crosvm.sock

multisubstitute {
  importas -Siu VM
  importas -Si WAYLAND_DISPLAY
}

if { chown vmm-${VM} env/crosvm.sock }

s6-envuidgid gpu-${VM}
s6-applyuidgid -UzG 15 # wayland
s6-ipcserverd -1c 1

bwrap
  --unshare-all
  # --unshare-all only implies --unshare-user-try.
  # Make this more than a "try".
  --unshare-user
  --bind $WAYLAND_DISPLAY $WAYLAND_DISPLAY
  --ro-bind /usr /usr
  --ro-bind /lib /lib
  --tmpfs /tmp
  --dev /dev
  --tmpfs /dev/shm
  --ro-bind /nix /nix
  --disable-userns
  --proc /proc
  --ro-bind /proc/sys /proc/sys
  --tmpfs /proc/fs
  --remount-ro /proc/fs
  --tmpfs /proc/irq
  --remount-ro /proc/irq
  --ro-bind /dev/null /proc/kallsyms
  --
crosvm --no-syslog device gpu
  --fd 0
  --wayland-sock $WAYLAND_DISPLAY
  --params "{\"context-types\":\"cross-domain\"}"