What are the best ways to run a game on sandboxed mode with only game HDD shared to it. There should not be network access for the game and there should be GPU (intel integrated) pass-through.
I have tried Gnome boxes, but GPU pass through is not working and checked distrobox, but that too shares HOME folder.
You can do this using Lutris.
- Install it from Flathub
- Open Lutris and have it install the tools it needs (wine, dxvk, etc)
- Close Lutris
- Use Flatseal to limit its permissions; remove network, filesystem access, etc
- Open Lutris and run the game
Note that this isn’t a perfect sandbox. For example, the game can still send a link to your browser to open. Theoretically it could do something malicious with that. Though you could probably work around that issue by changing your default browser to a flatpak version and disable network access there. There might be other small sandbox breaks, but nothing I can think of.
You can try Firejail
I got some answers to a similar question here https://lemm.ee/post/45993313
There are systemd nspawn Containers, you could install debian, or whatever you fancy inside, they provode simmillar isolation to docker containers and you can even integrate them with gui.
Containerized apps will then only see the container folder
Keep in mind that non-hardenized containers only protect you from bugs, they don’t protect you from sophisticated malware. If you suspect the software you are trying to run might be a virus, don’t run it, or run it in a virtual machine.
I would recommend using containers only if you absolutely understand how to make them secure AND you have no reason to suspect the software you are running might contain nefarious code. In any other case use a virtual machine.
true enough, video acceleration is a bit harder / more expensive with an extra gpu, thats why i shyed away from suggesting vms
im not on arch but the explanation is still valuable: https://wiki.archlinux.org/title/Systemd-nspawn
Don’t.
