bubblejail.services(5)

NAME

bubblejail.services - bubblejail instance service configuration.

SYNOPSIS

services.toml

DESCRIPTION

Bubblejail service is configuration is defined in the "services.toml" file located at ~/.local/share/bubblejail/instances/<instance_name>/services.toml

"services.toml" is a TOML formatted file.[1] Declaring a table will activate the service and key/values declared in the table will pass the settings to the service.

For example:

    	[home_share]
    	home_paths = ["Downloads"]

Will activate home_share service and share the Downloads folder from home directory with the sandbox.

AVAILABLE SERVICES

  common

Common Settings

Settings that don't fit in any particular category

Options:

executable_name: str | list[str]
    Default arguments to run when no arguments were provided

share_local_time: bool = False
    Deprecated

    This option has no effect since version 0.6.0

filter_disk_sync: bool = False
    Do not allow flushing disk. Useful for EA Origin client that tries to flush to disk too often.

dbus_name: str
    D-Bus name allowed to acquire and own

  x11

X11 windowing system

Gives access to X11 socket. This is generally the default Linux windowing system.

  wayland

Wayland windowing system

Make sure you are running Wayland session and your application supports Wayland

  network

Network access

Gives access to network.

  pulse_audio

Pulse Audio

Default audio system in most distros

  home_share

Home Share

Share directories or files relative to home

Options:

home_paths: list[str]
    Path to share with sandbox

  direct_rendering

Direct Rendering

Provides access to GPU

Options:

enable_aco: bool = False
    Deprecated

    Enables high performance vulkan shader compiler for AMD GPUs. Enabled by default since mesa 20.02

  systray

System tray icons

Provides access to D-Bus API for creating tray icons This is not the only way to create tray icons but the most common one.

  joystick

Joysticks and gamepads

Windowing systems (x11 and wayland) do not support gamepads. Every game has to read from device files directly. This service provides access to them.

  root_share

Root share

Share directories or files relative to root /

Options:

paths: list[str]
    Path to share with sandbox

read_only_paths: list[str]
    Path to share read-only with sandbox

  openjdk

Java

Deprecated: will be removed in the future

Enable for applications that require Java Example: Minecraft

  notify

Notifications

Ability to send notifications to desktop

  gnome_toolkit

GNOME toolkit

Access to GNOME APIs

Options:

gnome_portal: bool = False
    Access to GNOME Portal D-Bus API

dconf_dbus: bool = False
    Access to dconf D-Bus API

gnome_vfs_dbus: bool = False
    Access to GNOME Virtual File System D-Bus API

  pipewire

Pipewire

Pipewire sound and screencapture system

  v4l

Video4Linux

Video capture. (webcams and etc.)

  ibus

IBus input method

Gives access to IBus input method. This is generally the default input method for multilingual input.

  fcitx

Fcitx/Fcitx5 input method

Gives access to Fcitx/Fcitx5 input method. This is another popular input method framework.

  slirp4netns

Slirp4netns networking

Independent networking stack for sandbox. Requires slirp4netns executable.

Options:

dns_servers: list[str]
    DNS servers used. Internal DNS server is always used.

outbound_addr: str
    Address or device to bind to. If not set the default address would be used.

disable_host_loopback: bool = True
    Prohibit connecting to host's loopback interface

  namespaces_limits

Limit namespaces

Limit number of namespaces available inside sandbox. Namespace limits are recursive. Setting limit 0 blocks creating new namespaces. Setting -1 unlocks the limit.

Options:

user: int = 0
    Limiting user namespaces blocks acquiring new capabilities and privileges inside namespaces.

mount: int = 0
    Limits number mount namespaces.

pid: int = 0
    Limits number PID namespaces.

ipc: int = 0
    Limits number IPC namespaces.

net: int = 0
    Limits number net namespaces.

time: int = 0
    Limits number time namespaces.

uts: int = 0
    Limits number UTS namespaces.

cgroup: int = 0
    Limits number cgroups namespaces.

  debug

Debug options

Various debug options such as adding arguments to the bwrap or xdg-dbus-proxy.

Options:

raw_bwrap_args: list[str]
    Raw arguments to add to bwrap invocation. See bubblewrap documentation.

raw_dbus_session_args: list[str]
    Raw arguments to add to xdg-dbus-proxy session invocation. See xdg-dbus-proxy documentation.

raw_dbus_system_args: list[str]
    Raw arguments to add to xdg-dbus-proxy system invocation. See xdg-dbus-proxy documentation.

  gamemode

GameMode

Provides D-Bus access to the Feral's GameMode daemon D-Bus API. Use `gamemoderun` command to run a specific game with optimizations. For example, add `gamemoderun %command%` to Steam game launch options.

  pasta_network

pasta networking

Independent networking stack for sandbox. Requires pasta executable.

Options:

extra_args: list[str]
    Extra arguments to pass to pasta. For example, interface binding, port forwarding... See `passt` man page.

  mpris

MPRIS

Media Player Remote Interfacing Specification

Options:

player_name: str
    D-Bus name suffix the player wants to acquire. Accepts glob patterns. (for example `firefox.*`)

  xdg_desktop_portal

XDG Desktop Portal

D-Bus API that allows access for sandboxed application to resources outside of it.

Options:

add_flatpak_info: bool = False
    Add /.flatpak-info file to sandbox which some applications use as a trigger to use portals.

file_chooser: bool = False
    Enable File Chooser portal which allows spawning file chooser outside sandbox.

global_shortcuts: bool = False
    Enable Global Shortcuts portal which allows application to create shortcuts that will work on Wayland.

inhibit: bool = False
    Enable Inhibit portal which allows application to prevent desktop from suspending or idling.

notification: bool = False
    Enable Notification portal which allows application to send notifications.

open_uri: bool = False
    Enable OpenUri portal which allows opening files and links.

settings: bool = False
    Enable Settings portal which allows reading common GUI settings like dark mode.

trash: bool = False
    Enable Trash portal which allows sending trashed files to unified location outside sandbox.

screen_cast: bool = False
    Enable ScreenCast portal which allows creating screen cast sessions.

override_xdg_open: bool = False
    Override xdg-open with a version that uses portals. Currently depends on flatpak utils but will be replaced with a standalone version in the future.

SEE ALSO

bubblejail(1)

NOTES

1.  TOML configuration file format. https://toml.io/