No GPU acceleration for maximum isolation - option to opt-out

[kravemir]

I'd like to run GUI app(s) in (micro)VM with seamless windowing, but as confined as it gets.

QubesOS is quite heavy weight, so I'm searching for more lightweight VM-based alternative. And, microVM sounds great.

Side experiment: I managed to run wayland app in a container based on this, which needs only wayland socket to work (and, I managed to build sommelier and run X11 apps). But, containers provide less isolation than (micro)VM.

README contains:

GPU acceleration is also enabled on systems supporting DRM native context (freedreno, amdgpu, asahi).

But I didn't manage to find any option to opt-out from acceleration - fully software based rendering, maximum possible isolation.

[teohhanhui]

But I didn't manage to find any option to opt-out from acceleration - fully software based rendering, maximum possible isolation.

#195

[kravemir]

But I didn't manage to find any option to opt-out from acceleration - fully software based rendering, maximum possible isolation.

#195

The --gpu=software seems to be the solution.

How will a guest/microVM communicate with the host? Will there be lots of attack surface?