From 907d26af0bdaf8831a000274a32300501f9ce10f Mon Sep 17 00:00:00 2001 From: bilal Date: Sat, 27 Jun 2026 13:36:01 +0300 Subject: [PATCH] Stabilize Sunshine app launch profiles and container isolation. Update compose security settings and player app configs to improve Steam startup behavior, add desktop/manual launch entries for debugging, and align launch commands across all player profiles. Co-authored-by: Cursor --- Dockerfile | 4 ++-- docker-compose.yml | 8 +++----- players/p1_config/apps.json | 28 +++++++++++++++++++++++++++- players/p2_config/apps.json | 28 +++++++++++++++++++++++++++- players/p3_config/apps.json | 28 +++++++++++++++++++++++++++- players/p4_config/apps.json | 28 +++++++++++++++++++++++++++- 6 files changed, 113 insertions(+), 11 deletions(-) diff --git a/Dockerfile b/Dockerfile index c027424..251107e 100644 --- a/Dockerfile +++ b/Dockerfile @@ -13,7 +13,7 @@ RUN if [ -n "$APT_PROXY" ]; then \ RUN dpkg --add-architecture i386 && \ apt-get update && apt-get install -y \ xserver-xorg-core xserver-xorg-video-dummy xserver-xorg-input-libinput \ - fluxbox dbus-x11 xauth xfonts-base x11-xserver-utils \ + fluxbox dbus-x11 xauth xfonts-base x11-xserver-utils xinput \ software-properties-common wget curl ca-certificates locales pciutils \ libboost-chrono1.74.0 libboost-filesystem1.74.0 libboost-locale1.74.0 \ libboost-program-options1.74.0 libboost-thread1.74.0 \ @@ -47,6 +47,7 @@ RUN apt-get update && \ && ln -sf /lib/x86_64-linux-gnu/libvpx.so.7 /lib/x86_64-linux-gnu/libvpx.so.6 \ && ln -sf /lib/i386-linux-gnu/libvpx.so.7 /lib/i386-linux-gnu/libvpx.so.6 \ && locale-gen en_US.UTF-8 \ + && setcap -r /usr/bin/sunshine-v0.20.0 || true \ && rm -f /tmp/sunshine.deb \ && apt-get clean \ && rm -rf /var/lib/apt/lists/* @@ -91,7 +92,6 @@ id steam >/dev/null 2>&1 || useradd -m -s /bin/bash steam\n\ mkdir -p /home/steam/.local/share/Steam /tmp/xdg-steam\n\ ln -sfn /home/steam/.local/share/Steam /home/steam/.steam\n\ chown -R steam:steam /home/steam /tmp/xdg-steam\n\ -modprobe uinput >/dev/null 2>&1 || true\n\ mkdir -p /run/dbus\n\ dbus-daemon --system --fork || true\n\ Xorg :99 -config /etc/X11/xorg-dummy.conf -nolisten tcp -noreset +extension GLX +extension RANDR +extension RENDER &\n\ diff --git a/docker-compose.yml b/docker-compose.yml index 13fbd9a..d73eb30 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -5,7 +5,9 @@ x-game-template: &game-template APT_PROXY: ${APT_PROXY:-} user: "root" restart: unless-stopped - privileged: true + security_opt: + - seccomp:unconfined + - apparmor:unconfined ipc: shareable environment: NVIDIA_DRIVER_CAPABILITIES: all @@ -44,7 +46,6 @@ services: volumes: - /DATA/AppData/game-server/players/p1_steam:/home/steam/.local/share/Steam - /DATA/AppData/game-server/players/p1_config:/root/.config/sunshine - - /run/udev:/run/udev:ro # Добавляем логирование для отладки logging: driver: "json-file" @@ -68,7 +69,6 @@ services: volumes: - /DATA/AppData/game-server/players/p2_steam:/home/steam/.local/share/Steam - /DATA/AppData/game-server/players/p2_config:/root/.config/sunshine - - /run/udev:/run/udev:ro logging: driver: "json-file" options: @@ -91,7 +91,6 @@ services: volumes: - /DATA/AppData/game-server/players/p3_steam:/home/steam/.local/share/Steam - /DATA/AppData/game-server/players/p3_config:/root/.config/sunshine - - /run/udev:/run/udev:ro logging: driver: "json-file" options: @@ -114,7 +113,6 @@ services: volumes: - /DATA/AppData/game-server/players/p4_steam:/home/steam/.local/share/Steam - /DATA/AppData/game-server/players/p4_config:/root/.config/sunshine - - /run/udev:/run/udev:ro logging: driver: "json-file" options: diff --git a/players/p1_config/apps.json b/players/p1_config/apps.json index 475faa9..40e90b3 100644 --- a/players/p1_config/apps.json +++ b/players/p1_config/apps.json @@ -6,7 +6,33 @@ { "name": "Steam Big Picture", "detached": [ - "bash -lc 'id steam >/dev/null 2>&1 || useradd -m -s /bin/bash steam; ROOT=/home/steam/.local/share/Steam/debian-installation; mkdir -p ${ROOT} /tmp/xdg-steam /home/steam/tmp; ln -sfn /home/steam/.local/share/Steam /home/steam/.steam; chown -R steam:steam /home/steam /tmp/xdg-steam; runuser -u steam -- nohup env DISPLAY=:99 HOME=/home/steam XDG_RUNTIME_DIR=/tmp/xdg-steam TMPDIR=/home/steam/tmp LANG=en_US.UTF-8 LC_ALL=en_US.UTF-8 bash -lc \"cd ${ROOT} && exec dbus-run-session -- /usr/games/steam -tenfoot -fullscreen -no-cef-sandbox\" >/home/steam/steam-app.log 2>&1 < /dev/null &'" + "bash -lc 'id steam >/dev/null 2>&1 || useradd -m -s /bin/bash steam; ROOT=/home/steam/.local/share/Steam/debian-installation; mkdir -p ${ROOT} /tmp/xdg-steam /home/steam/tmp; ln -sfn /home/steam/.local/share/Steam /home/steam/.steam; chown -R steam:steam /home/steam /tmp/xdg-steam; pkill -u steam -f \"steam|steamwebhelper|steam-runtime\" >/dev/null 2>&1 || true; sleep 1; runuser -u steam -- env DISPLAY=:99 HOME=/home/steam XDG_RUNTIME_DIR=/tmp/xdg-steam TMPDIR=/home/steam/tmp LANG=en_US.UTF-8 LC_ALL=en_US.UTF-8 nohup bash -lc \"cd ${ROOT} && exec /usr/games/steam -gamepadui -fullscreen -no-cef-sandbox\" >/home/steam/steam-app.log 2>&1 < /dev/null &'" + ], + "prep-cmd": [ + { + "do": "", + "undo": "" + } + ], + "image-path": "steam.png" + }, + { + "name": "Desktop Test", + "detached": [ + "bash -lc 'echo desktop-test-started >/tmp/desktop-test.log'" + ], + "prep-cmd": [ + { + "do": "", + "undo": "" + } + ], + "image-path": "desktop.png" + }, + { + "name": "Steam Manual Start", + "detached": [ + "bash -lc 'id steam >/dev/null 2>&1 || useradd -m -s /bin/bash steam; ROOT=/home/steam/.local/share/Steam/debian-installation; mkdir -p ${ROOT} /tmp/xdg-steam /home/steam/tmp; ln -sfn /home/steam/.local/share/Steam /home/steam/.steam; chown -R steam:steam /home/steam /tmp/xdg-steam; pkill -u steam -f \"steam|steamwebhelper|steam-runtime\" >/dev/null 2>&1 || true; sleep 1; runuser -u steam -- env DISPLAY=:99 HOME=/home/steam XDG_RUNTIME_DIR=/tmp/xdg-steam TMPDIR=/home/steam/tmp LANG=en_US.UTF-8 LC_ALL=en_US.UTF-8 nohup bash -lc \"cd ${ROOT} && exec /usr/games/steam -gamepadui -fullscreen -no-cef-sandbox\" >/home/steam/steam-app.log 2>&1 < /dev/null &'" ], "prep-cmd": [ { diff --git a/players/p2_config/apps.json b/players/p2_config/apps.json index 475faa9..40e90b3 100644 --- a/players/p2_config/apps.json +++ b/players/p2_config/apps.json @@ -6,7 +6,33 @@ { "name": "Steam Big Picture", "detached": [ - "bash -lc 'id steam >/dev/null 2>&1 || useradd -m -s /bin/bash steam; ROOT=/home/steam/.local/share/Steam/debian-installation; mkdir -p ${ROOT} /tmp/xdg-steam /home/steam/tmp; ln -sfn /home/steam/.local/share/Steam /home/steam/.steam; chown -R steam:steam /home/steam /tmp/xdg-steam; runuser -u steam -- nohup env DISPLAY=:99 HOME=/home/steam XDG_RUNTIME_DIR=/tmp/xdg-steam TMPDIR=/home/steam/tmp LANG=en_US.UTF-8 LC_ALL=en_US.UTF-8 bash -lc \"cd ${ROOT} && exec dbus-run-session -- /usr/games/steam -tenfoot -fullscreen -no-cef-sandbox\" >/home/steam/steam-app.log 2>&1 < /dev/null &'" + "bash -lc 'id steam >/dev/null 2>&1 || useradd -m -s /bin/bash steam; ROOT=/home/steam/.local/share/Steam/debian-installation; mkdir -p ${ROOT} /tmp/xdg-steam /home/steam/tmp; ln -sfn /home/steam/.local/share/Steam /home/steam/.steam; chown -R steam:steam /home/steam /tmp/xdg-steam; pkill -u steam -f \"steam|steamwebhelper|steam-runtime\" >/dev/null 2>&1 || true; sleep 1; runuser -u steam -- env DISPLAY=:99 HOME=/home/steam XDG_RUNTIME_DIR=/tmp/xdg-steam TMPDIR=/home/steam/tmp LANG=en_US.UTF-8 LC_ALL=en_US.UTF-8 nohup bash -lc \"cd ${ROOT} && exec /usr/games/steam -gamepadui -fullscreen -no-cef-sandbox\" >/home/steam/steam-app.log 2>&1 < /dev/null &'" + ], + "prep-cmd": [ + { + "do": "", + "undo": "" + } + ], + "image-path": "steam.png" + }, + { + "name": "Desktop Test", + "detached": [ + "bash -lc 'echo desktop-test-started >/tmp/desktop-test.log'" + ], + "prep-cmd": [ + { + "do": "", + "undo": "" + } + ], + "image-path": "desktop.png" + }, + { + "name": "Steam Manual Start", + "detached": [ + "bash -lc 'id steam >/dev/null 2>&1 || useradd -m -s /bin/bash steam; ROOT=/home/steam/.local/share/Steam/debian-installation; mkdir -p ${ROOT} /tmp/xdg-steam /home/steam/tmp; ln -sfn /home/steam/.local/share/Steam /home/steam/.steam; chown -R steam:steam /home/steam /tmp/xdg-steam; pkill -u steam -f \"steam|steamwebhelper|steam-runtime\" >/dev/null 2>&1 || true; sleep 1; runuser -u steam -- env DISPLAY=:99 HOME=/home/steam XDG_RUNTIME_DIR=/tmp/xdg-steam TMPDIR=/home/steam/tmp LANG=en_US.UTF-8 LC_ALL=en_US.UTF-8 nohup bash -lc \"cd ${ROOT} && exec /usr/games/steam -gamepadui -fullscreen -no-cef-sandbox\" >/home/steam/steam-app.log 2>&1 < /dev/null &'" ], "prep-cmd": [ { diff --git a/players/p3_config/apps.json b/players/p3_config/apps.json index 475faa9..40e90b3 100644 --- a/players/p3_config/apps.json +++ b/players/p3_config/apps.json @@ -6,7 +6,33 @@ { "name": "Steam Big Picture", "detached": [ - "bash -lc 'id steam >/dev/null 2>&1 || useradd -m -s /bin/bash steam; ROOT=/home/steam/.local/share/Steam/debian-installation; mkdir -p ${ROOT} /tmp/xdg-steam /home/steam/tmp; ln -sfn /home/steam/.local/share/Steam /home/steam/.steam; chown -R steam:steam /home/steam /tmp/xdg-steam; runuser -u steam -- nohup env DISPLAY=:99 HOME=/home/steam XDG_RUNTIME_DIR=/tmp/xdg-steam TMPDIR=/home/steam/tmp LANG=en_US.UTF-8 LC_ALL=en_US.UTF-8 bash -lc \"cd ${ROOT} && exec dbus-run-session -- /usr/games/steam -tenfoot -fullscreen -no-cef-sandbox\" >/home/steam/steam-app.log 2>&1 < /dev/null &'" + "bash -lc 'id steam >/dev/null 2>&1 || useradd -m -s /bin/bash steam; ROOT=/home/steam/.local/share/Steam/debian-installation; mkdir -p ${ROOT} /tmp/xdg-steam /home/steam/tmp; ln -sfn /home/steam/.local/share/Steam /home/steam/.steam; chown -R steam:steam /home/steam /tmp/xdg-steam; pkill -u steam -f \"steam|steamwebhelper|steam-runtime\" >/dev/null 2>&1 || true; sleep 1; runuser -u steam -- env DISPLAY=:99 HOME=/home/steam XDG_RUNTIME_DIR=/tmp/xdg-steam TMPDIR=/home/steam/tmp LANG=en_US.UTF-8 LC_ALL=en_US.UTF-8 nohup bash -lc \"cd ${ROOT} && exec /usr/games/steam -gamepadui -fullscreen -no-cef-sandbox\" >/home/steam/steam-app.log 2>&1 < /dev/null &'" + ], + "prep-cmd": [ + { + "do": "", + "undo": "" + } + ], + "image-path": "steam.png" + }, + { + "name": "Desktop Test", + "detached": [ + "bash -lc 'echo desktop-test-started >/tmp/desktop-test.log'" + ], + "prep-cmd": [ + { + "do": "", + "undo": "" + } + ], + "image-path": "desktop.png" + }, + { + "name": "Steam Manual Start", + "detached": [ + "bash -lc 'id steam >/dev/null 2>&1 || useradd -m -s /bin/bash steam; ROOT=/home/steam/.local/share/Steam/debian-installation; mkdir -p ${ROOT} /tmp/xdg-steam /home/steam/tmp; ln -sfn /home/steam/.local/share/Steam /home/steam/.steam; chown -R steam:steam /home/steam /tmp/xdg-steam; pkill -u steam -f \"steam|steamwebhelper|steam-runtime\" >/dev/null 2>&1 || true; sleep 1; runuser -u steam -- env DISPLAY=:99 HOME=/home/steam XDG_RUNTIME_DIR=/tmp/xdg-steam TMPDIR=/home/steam/tmp LANG=en_US.UTF-8 LC_ALL=en_US.UTF-8 nohup bash -lc \"cd ${ROOT} && exec /usr/games/steam -gamepadui -fullscreen -no-cef-sandbox\" >/home/steam/steam-app.log 2>&1 < /dev/null &'" ], "prep-cmd": [ { diff --git a/players/p4_config/apps.json b/players/p4_config/apps.json index 475faa9..40e90b3 100644 --- a/players/p4_config/apps.json +++ b/players/p4_config/apps.json @@ -6,7 +6,33 @@ { "name": "Steam Big Picture", "detached": [ - "bash -lc 'id steam >/dev/null 2>&1 || useradd -m -s /bin/bash steam; ROOT=/home/steam/.local/share/Steam/debian-installation; mkdir -p ${ROOT} /tmp/xdg-steam /home/steam/tmp; ln -sfn /home/steam/.local/share/Steam /home/steam/.steam; chown -R steam:steam /home/steam /tmp/xdg-steam; runuser -u steam -- nohup env DISPLAY=:99 HOME=/home/steam XDG_RUNTIME_DIR=/tmp/xdg-steam TMPDIR=/home/steam/tmp LANG=en_US.UTF-8 LC_ALL=en_US.UTF-8 bash -lc \"cd ${ROOT} && exec dbus-run-session -- /usr/games/steam -tenfoot -fullscreen -no-cef-sandbox\" >/home/steam/steam-app.log 2>&1 < /dev/null &'" + "bash -lc 'id steam >/dev/null 2>&1 || useradd -m -s /bin/bash steam; ROOT=/home/steam/.local/share/Steam/debian-installation; mkdir -p ${ROOT} /tmp/xdg-steam /home/steam/tmp; ln -sfn /home/steam/.local/share/Steam /home/steam/.steam; chown -R steam:steam /home/steam /tmp/xdg-steam; pkill -u steam -f \"steam|steamwebhelper|steam-runtime\" >/dev/null 2>&1 || true; sleep 1; runuser -u steam -- env DISPLAY=:99 HOME=/home/steam XDG_RUNTIME_DIR=/tmp/xdg-steam TMPDIR=/home/steam/tmp LANG=en_US.UTF-8 LC_ALL=en_US.UTF-8 nohup bash -lc \"cd ${ROOT} && exec /usr/games/steam -gamepadui -fullscreen -no-cef-sandbox\" >/home/steam/steam-app.log 2>&1 < /dev/null &'" + ], + "prep-cmd": [ + { + "do": "", + "undo": "" + } + ], + "image-path": "steam.png" + }, + { + "name": "Desktop Test", + "detached": [ + "bash -lc 'echo desktop-test-started >/tmp/desktop-test.log'" + ], + "prep-cmd": [ + { + "do": "", + "undo": "" + } + ], + "image-path": "desktop.png" + }, + { + "name": "Steam Manual Start", + "detached": [ + "bash -lc 'id steam >/dev/null 2>&1 || useradd -m -s /bin/bash steam; ROOT=/home/steam/.local/share/Steam/debian-installation; mkdir -p ${ROOT} /tmp/xdg-steam /home/steam/tmp; ln -sfn /home/steam/.local/share/Steam /home/steam/.steam; chown -R steam:steam /home/steam /tmp/xdg-steam; pkill -u steam -f \"steam|steamwebhelper|steam-runtime\" >/dev/null 2>&1 || true; sleep 1; runuser -u steam -- env DISPLAY=:99 HOME=/home/steam XDG_RUNTIME_DIR=/tmp/xdg-steam TMPDIR=/home/steam/tmp LANG=en_US.UTF-8 LC_ALL=en_US.UTF-8 nohup bash -lc \"cd ${ROOT} && exec /usr/games/steam -gamepadui -fullscreen -no-cef-sandbox\" >/home/steam/steam-app.log 2>&1 < /dev/null &'" ], "prep-cmd": [ {