search

Steam-Headless / docker-steam-headless

A Headless Steam Docker image supporting NVIDIA GPU and accessible via Web UI
GNU General Public License v2.0
908 stars 89 forks source link

Image perm tweaks and process #72

Closed thelamer closed 1 year ago

thelamer commented 1 year ago

Is your feature request related to a problem?

No

What is your feature request?

I have been working on a steamOS image https://github.com/linuxserver/docker-steamos/tree/initial and discovered a bunch by the process. The core tech I use for rendering is a virtual framebuffer using KasmVNC which only supports DRI3 (AMD/Intel ARC) so it will never have feature parity with your image, but more concentrating on the development side of making stuff for the Deck without having a Deck. In any case I discovered that privileged is not needed among other things for remote play.

--security-opt seccomp=unconfined
--security-opt apparmor=unconfined
--cap-add=NET_ADMIN
-p 27031-27036:27031-27036/udp 
-p 27031-27036:27031-27036
-v /dev/input:/dev/input
-v /run/udev/data:/run/udev/data
--device /dev/dri:/dev/dri
--hostname UNDERLYINGHOSTHOSTNAME
-e HOST_IP=UNDERLYINGHOSTIP

apparmor is only on debian systems, input mounts are for controller support, the hostname and ip need to be combined with in container logic that performs this on init: (where net admin comes into play)

ip route delete default
ip route add UNDERLYINGHOSTIP dev eth0
ip route add default via UNDERLYINGHOSTIP

This is needed for the broadcast packets to make it out of the docker subnet for remote play comms on a local network. And the hostname setting is needed to ensure they make it back. Piped through Valve servers when fully remote still works with these settings in place.

There is a bunch of other logic at play here for render device perms etc, but this is the basics and reduces the complexity for the user, especially networking. Also makes dbus much easier to run inside a non priv container. Unfortunately multi tennent servers is still not possible due to the hard coded port range Steam uses.

Do you have a discord or something like that? I would love to pick your brain on what can be done here to improve the container, I am always on the LSIO discord.

Are there any workarounds?

No response

Additional Context

No response

Josh5 commented 1 year ago

Come chat with me here. Sounds like it could be a great conversation. https://discord.gg/9H2jdd6RNt