wayland nested weston container

sandbox

#!/bin/bash

if ! podman image exists sandbox; then
    cat << EOF > /tmp/sandbox.containerfile
FROM debian:12

RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \
    dbus-x11 \
    weston \
    xterm \
    sudo \
    firefox-esr \
    pcmanfm \
    fonts-noto-cjk \
 && rm -rf /var/lib/apt/lists/*

ARG USER=user
ARG UID=1000
ARG GID=1000

RUN groupadd -g \$GID \$USER && \
    useradd -m -u \$UID -g \$GID -s /bin/bash \$USER && \
    echo "\$USER ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/\$USER && \
    chmod 0440 /etc/sudoers.d/\$USER

USER \$USER
WORKDIR /home/\$USER

ENV SHELL=/bin/bash \
    WAYLAND_DISPLAY=wayland-1 \
    MOZ_ENABLE_WAYLAND=1 \
    HOME=/home/\$USER

ENTRYPOINT ["weston", "--fullscreen"]
EOF

    podman build -t sandbox -f /tmp/sandbox.containerfile /tmp
    rm /tmp/sandbox.containerfile
fi

podman run --rm -d --security-opt label=disable \
    --env="WAYLAND_DISPLAY" \
    --env="XDG_RUNTIME_DIR" \
    --volume="${XDG_RUNTIME_DIR}:${XDG_RUNTIME_DIR}" \
    --userns=keep-id \
    --volume="${HOME}/Downloads:/home/user/Downloads:z" \
    sandbox~/Lab/sandbox $