pw-container

Run apps in isolated PipeWire security contexts

TLDR

Create a new security context and print its socket address

$ pw-container

Run a program within a new security context

$ pw-container [command] [arg1] [arg2]

Run connecting to a specific remote PipeWire instance

$ pw-container -r [remote_name] [command]

Run with specific security properties using JSON

$ pw-container -P '{"pipewire.sec.app-id": "[my-app]"}' [command]

Display help

$ pw-container -h

SYNOPSIS

pw-container [options] [command] [arguments...]

pw-container creates a new security context using the PipeWire SecurityContext extension API. It sets up a temporary Unix socket as a server with the given properties, and clients created from this socket have the security properties attached to them.If a command is specified, it is executed within the new security context. If no command is given, the socket address is printed to standard output. The process does not exit until terminated with a signal (exits 0 on SIGINT/SIGTERM).This is useful for sandboxing applications or running programs with restricted PipeWire access.