PeterCxy/dobu
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Compare commits

base: PeterCxy:383f04133c0f1cde57159daba11690118cb0fe85
Branches Tags
PeterCxy:main
..
compare: PeterCxy:38229d567ecc2a185be772652ff31f006a04a947
Branches Tags
PeterCxy:main

No commits in common. "383f04133c0f1cde57159daba11690118cb0fe85" and "38229d567ecc2a185be772652ff31f006a04a947" have entirely different histories.
383f04133c ... 38229d567e

4 changed files with 6 additions and 9 deletions
Show stats Expand all files Collapse all files

5
apps/bottles/Containerfile
View file

@ -3,7 +3,7 @@ FROM dobu/deps-base-archlinux:latest
ARG UPSTREAM_VERSION ARG UPSTREAM_VERSION
RUN pacman --noconfirm -Syu && \ RUN pacman --noconfirm -Syu && \
pacman --noconfirm -S base-devel git sudo gnupg freetype2 lib32-freetype2 gnutls pacman --noconfirm -S base-devel git sudo gnupg
RUN mkdir /src && chown user:user /src RUN mkdir /src && chown user:user /src
RUN echo "user ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers RUN echo "user ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
@ -12,6 +12,8 @@ WORKDIR /src
WORKDIR /home/user WORKDIR /home/user
RUN sudo rm -rf /src RUN sudo rm -rf /src
# machine-id is required for dconf/gsettings
RUN sudo dbus-uuidgen --ensure
RUN git clone https://aur.archlinux.org/icoextract.git && \ RUN git clone https://aur.archlinux.org/icoextract.git && \
cd icoextract && makepkg --noconfirm -sci cd icoextract && makepkg --noconfirm -sci
@ -38,7 +40,6 @@ RUN git clone https://aur.archlinux.org/bottles.git && \
cd bottles && makepkg --noconfirm -sci cd bottles && makepkg --noconfirm -sci
LABEL net.typeblog.dobu.desktop_file_path=/usr/share/applications/com.usebottles.bottles.desktop LABEL net.typeblog.dobu.desktop_file_path=/usr/share/applications/com.usebottles.bottles.desktop
LABEL net.typeblog.dobu.unsafe_i_know_what_i_am_doing_seccomp_unconfined=true
LABEL net.typeblog.dobu.x11_required=true LABEL net.typeblog.dobu.x11_required=true
ENTRYPOINT [ "/usr/bin/bash", "-c", "export $(dbus-launch) && /usr/bin/bottles" ] ENTRYPOINT [ "/usr/bin/bash", "-c", "export $(dbus-launch) && /usr/bin/bottles" ]

2
deps/compositor-sandbox/Containerfile vendored
View file

@ -1,5 +1,5 @@
ARG WL_MITM_COMMIT=d133a2faa1732f8e3573fa81ef628fcc70a778f9 ARG WL_MITM_COMMIT=d133a2faa1732f8e3573fa81ef628fcc70a778f9
ARG XWAYLAND_SATELLITE_COMMIT=ba78881a68182ce338041846164cbfed0d70935c ARG XWAYLAND_SATELLITE_COMMIT=10cb041a80bb815cc1789cfa305923f1f9e3713d
FROM docker.io/archlinux:base-devel-20250302.0.316047 AS builder-rust FROM docker.io/archlinux:base-devel-20250302.0.316047 AS builder-rust

4
dobu-run.sh
View file

@ -32,8 +32,6 @@ if [ "$(get_image_label "$image_name" net.typeblog.dobu.unsafe_i_know_what_i_am_
log "This is considered UNSAFE; DO NOT USE if the app inside container does not do its own sandboxing" log "This is considered UNSAFE; DO NOT USE if the app inside container does not do its own sandboxing"
log "DO NOT USE if you don't trust sandboxing done by the app inside" log "DO NOT USE if you don't trust sandboxing done by the app inside"
update_podman_security_args "seccomp_unsafe.json" update_podman_security_args "seccomp_unsafe.json"
elif [ "$(get_image_label "$image_name" net.typeblog.dobu.unsafe_i_know_what_i_am_doing_seccomp_unconfined)" == "true" ]; then
update_podman_security_args "unconfined"
fi fi
x11_required=false x11_required=false
@ -132,7 +130,7 @@ if [[ "$(declare -p ${bind_mount_var_name} 2>&1)" =~ "declare -a" ]]; then
fi fi
# The fun part: start the container! # The fun part: start the container!
podman run --rm "${podman_security_args[@]}" --name "$container_name" -h "$(hostname)" \ podman run --rm "${podman_security_args[@]}" --name "$container_name" \
`# Create tmpfs mountpoints for runtime directories` \ `# Create tmpfs mountpoints for runtime directories` \
--mount type=tmpfs,destination=/xdg_runtime,chown,tmpfs-mode=0700 \ --mount type=tmpfs,destination=/xdg_runtime,chown,tmpfs-mode=0700 \
--mount type=tmpfs,destination=/tmp/.X11-unix,chown,tmpfs-mode=0700 \ --mount type=tmpfs,destination=/tmp/.X11-unix,chown,tmpfs-mode=0700 \

4
functions.sh
View file

@ -13,8 +13,6 @@ DOBU_TMP=/tmp/dobu
update_podman_security_args() { update_podman_security_args() {
local seccomp_profile="$1" local seccomp_profile="$1"
[ -z "$seccomp_profile" ] && seccomp_profile="seccomp.json" [ -z "$seccomp_profile" ] && seccomp_profile="seccomp.json"
local seccomp_profile_path="$script_path/assets/$seccomp_profile"
[ "$seccomp_profile" == "unconfined" ] && seccomp_profile_path="$seccomp_profile"
# Default security-related arguments ALWAYS passed to podman # Default security-related arguments ALWAYS passed to podman
# Install a seccomp filter that disallows sub-namespaces which could lead to exploits # Install a seccomp filter that disallows sub-namespaces which could lead to exploits
# and use the keep-id mode of userns, such that the user 1100 is mapped to the # and use the keep-id mode of userns, such that the user 1100 is mapped to the
@ -22,7 +20,7 @@ update_podman_security_args() {
# large uid on the host. # large uid on the host.
podman_security_args=( podman_security_args=(
--security-opt --security-opt
seccomp="$seccomp_profile_path" seccomp="$script_path/assets/$seccomp_profile"
--userns=keep-id:uid=1100,gid=1100 --userns=keep-id:uid=1100,gid=1100
) )
} }