[GH-ISSUE #5] Isolation from host #6

New issue

Closed

opened 2026-10-30 21:32:21 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-30 21:32:21 +00:00

Owner

Originally created by @Markus328 on GitHub (Feb 15, 2026).
Original GitHub issue: https://github.com/joleuger/vuinputd/issues/5

I don't know very well of I did the setup correctly.

I'm running a nixos container (essentially a systemd-nspawn with --boot), and I want to run a headless sway session and control it with sunshine.

Adding udev rules from virtual devices from the container to protect the host against them, is the main goal of this, right?

I just ran vuinputd as root on host, and bind mounted it on container and also added "char-input rwm" device permission to the container since the container couldn't even access its own virtual devices (Operation not Permitted).

The issue is, removing and adding hot-plug physical devices makes the kernel adds them also to the comtainer's /dev, and the container recognize's them as valid input and I got this unwantes behavior.

How to make the container have permission to its own virtual devices created by and only by the own comtainer?

Originally created by @Markus328 on GitHub (Feb 15, 2026). Original GitHub issue: https://github.com/joleuger/vuinputd/issues/5 I don't know very well of I did the setup correctly. I'm running a nixos container (essentially a systemd-nspawn with --boot), and I want to run a headless sway session and control it with sunshine. Adding udev rules from virtual devices from the container to protect the host against them, is the main goal of this, right? I just ran `vuinputd` as root on host, and bind mounted it on container and also added "char-input rwm" device permission to the container since the container couldn't even access its own virtual devices (Operation not Permitted). The issue is, removing and adding hot-plug physical devices makes the kernel adds them also to the comtainer's /dev, and the container recognize's them as valid input and I got this unwantes behavior. How to make the container have permission to its own virtual devices created by and only by the own comtainer?

bsakaguchi closed this issue

2026-10-30 21:32:21 +00:00

bsakaguchi commented

2026-10-30 21:32:22 +00:00

Author

Owner

@Markus328 commented on GitHub (Feb 15, 2026):

I could not reproduce the issue, my mouse is not being created at container's dev anymore, maybe I did something wrong. Closing

@Markus328 commented on GitHub (Feb 15, 2026): I could not reproduce the issue, my mouse is not being created at container's dev anymore, maybe I did something wrong. Closing

bsakaguchi commented

2026-10-30 21:32:22 +00:00

Author

Owner

@Markus328 commented on GitHub (Feb 15, 2026):

I just think this happened because I connected my mouse using bluetooth in smartphone and used it with sunshine (that is inside container). Maybe the device id somehow is allowed by vuinputd and when I connect it to pc as a physical hardware (not on smartphone) the daemon whitelists it. Anyway, it was just a test and I don't pretend to use mouse on smartphone

@Markus328 commented on GitHub (Feb 15, 2026): I just think this happened because I connected my mouse using bluetooth in smartphone and used it with sunshine (that is inside container). Maybe the device id somehow is allowed by vuinputd and when I connect it to pc as a physical hardware (not on smartphone) the daemon whitelists it. Anyway, it was just a test and I don't pretend to use mouse on smartphone

bsakaguchi referenced this issue

2026-10-30 21:32:30 +00:00

[GH-ISSUE #11] Incus container support #11