Running Wine inside an unpriviliged LXC Container as a secondary user, utilizing the host systems OpenGL 3D acceleration and PulseAudio.
Allow access to the display server and audio. Note that you should restrict this in a real world setup (e.g. auth-ip-acl):
migue@host$ xhost + # allow remote X access
add this lines to /etc/pulse/default.pa and restart pulsaudio:
load-module module-native-protocol-tcp auth-anonymous=1
load-module module-zeroconf-publish
1. In order to allow the creation of virutal network bridges as our
secondary user, add the following two lines to /etc/lxc/lxc-usernet:
retard2 veth virbr0 2
retard2 veth lxcbr0 10
2. Login as retard2 ("su" does not work well with cgroups)
miguel@host$ sudo machinectl login # than login as retard2
retard2@host$ cat /proc/self/cgroup # just check cgroups if you want
3. Add subuid subgid mappings to /home/retard2/.config/lxc/default.conf
You can check the ranges in /etc/subuid and /etc/subgid:
lxc.id_map = u 0 1541792 65536
lxc.id_map = g 0 1541792 65536
4. We are ready to create the lxc container as retard2:
retard2@host$ lxc-create -n winebox -t download
Select exactly the same distro / version / arch as you run on the
host. i.e. debian / stretch / amd64
retard2@host$ lxc-ls # assure that "winebox" LXC was created
5. Adapt the new config in: ~/.local/share/lxc/winebox/config adding:
# NET
lxc.network.type = veth
lxc.network.link = lxcbr0
lxc.network.flags = up
lxc.network.hwaddr = 00:16:3e:be:3c:5a
# X
lxc.mount.entry = /dev/dri dev/dri none bind,create=dir
lxc.mount.entry = /tmp/.X11-unix tmp/.X11-unix none bind,create=dir
# NVIDIA
lxc.mount.entry = /dev/nvidia0 dev/nvidia0 none bind,create=file
lxc.mount.entry = /dev/nvidiactl dev/nvidiactl none bind,create=file
6. Finally start the container and enter its realm:
retard2@host$ lxc-start -n winebox
retard2@host$ lxc-ls --running # check it is up & running
retard2@host$ lxc-attach -n winebox -- su # enter container (as root)
1. Adapt /etc/apt/sources.list to make use of "contrib" and "non-free"
and run:
root@winebox$ apt update
2. Get OpenGL running
root@winebox$ apt upgrade
root@winebox$ apt install mesa-utils
root@winebox$ apt install xserver-xorg-video-nvidia
root@winebox$ DISPLAY=:0 glxgears # check
root@winebox$ DISPLAY=:0 glxinfo | grep "direct render" # check
3. Get PulseAudio running.
Please adapt the IP to the host's lxcbr0 ip address.
root@winebox$ apt install pavucontrol
root@winebox$ DISPLAY=:0 PULSE_SERVER=10.0.5.1 pavucontrol
At this point we should have accelerated video and audio running from
inside our LXC. Well Done!
A few trivial requirements:
root@winebox$ apt install wget
root@winebox$ apt install gnupg
root@winebox$ apt install apt-transport-https
Now let’s get some wine accoring to: https://wiki.winehq.org/Debian:
root@winebox$ sudo dpkg --add-architecture i386
root@winebox$ wget -nc https://dl.winehq.org/wine-builds/Release.key
root@winebox$ sudo apt-key add Release.key
Add the debian stretch wine repo to your /etc/apt/sources.list:
deb https://dl.winehq.org/wine-builds/debian/ stretch main
root@winebox$ apt update
root@winebox$ apt-get install --install-recommends winehq-stable
Unfortunatelly wine still depends on the 32-bit versions of some libs so we have to replace our 64-bit verions by running:
root@winebox$ apt install libgl1-nvidia-glx:i386
Now You can optionally restrict any communication with the outside world:
miguel@host$ sudo iptables -F FORWARD #block traffic
miguel@host$ sudo iptables -P FORWARD DROP #block traffic
If your host is forwarding traffic you will need to set up some rules.
1. Create a non-root user:
root@winebox$ adduser lxc-retard
2. Now we can exit the container with :
root@winebox$ exit
3. Stop the container on the host. This might take some while.
retard2@host$ lxc-stop -n winebox
4. THIS WOULD BE A VERY GOOD MOMENT TO SNAPSHOT THE CONTIANER
FOR LATER REUSE!
Congratulations! Now you are running “wine” as an unprivileged user inside of an unprivileged container of a secondary user, utlizing your hosts hardware acceleration and PulseAudio capabilities.
Optionally traffic forwarding has been blocked, for increased security.
To use your new container you will need to go through the following steps each time:
miguel@host$ xhost +
miguel@host$ sudo iptables -F FORWARD #block traffic
miguel@host$ sudo iptables -P FORWARD DROP #block traffic
miguel$host$ sudo machinectl login # and login as retard2
retard2@host$ lxc-start -n winebox
Now you can attach to the container as lxc-retard user:
retard2@host$ lxc-attach -n winebox -- su lxc-retard
Alternatively we can attach as root:
retard2@host$ lxc-attach -n winebox -- su
Do not forget to stop container once you are finished:
retard2@host$ lxc-stop -n winebox
Remember that stopping might take a while. Be patient!
Make sure to automate/adapt the process, according to your personal preferences and requirements.