hyprland

Version	2026.243.1018
Repo	box/github.com/opencharly/pod-hyprland:v2026.243.1021

The nested-compositor primitive: Hyprland running inside a parent Wayland display, with its Lua config, its session launcher, and the file-capability strip that lets it exec under a pod’s no-new-privileges.

Hyprland is ALWAYS nested here — it has no headless-only mode. The binary exposes no –headless flag and no HYPRLAND_HEADLESS_ONLY (verified against the shipped binary’s strings and –help), and Aquamarine’s DRM backend needs a KMS card node a rootless pod never gets; a standalone attempt aborts with CBackend::create() failed!. So every bed composing this candy must supply a parent display, and that parent must clear two bars: it must advertise zwp_linux_dmabuf_v1 (Aquamarine’s Wayland backend hard-requires it, so a software-rendered parent will not do) and bind xdg_wm_base at version 6. The whole wlroots family is one version short today; gst-wayland-display (Smithay) clears both, which is why this nesting works at all.

Two details that are silent failures if missed. setcap -r on the binary: a file-capability binary cannot exec under no-new-privileges. And LIBSEAT_BACKEND=noop, not none — none is not a libseat backend name and only appears to work by inducing EINVAL.

Packages

Installed on every distro:

• hyprland
• hyprlock
• xorg-xwayland
• libcap
• grim
• wl-clipboard
• wtype
• wlr-randr

Services

• cstream-hyprland

Acceptance plan

This candy’s plan: — the runnable spec charly check executes against a live deployment. check: steps are idempotent probes; run: steps change state.

Intent	Step
run	stage the Lua config — Hyprland 0.55+ is Lua-only, hyprlang is gone
run	stage the hyprlock config
run	stage the session launcher
run	strip file capabilities from the Hyprland binary
check	the Hyprland binary is installed
check	the Hyprland binary carries NO file capabilities — it must exec under no-new-privileges
check	Hyprland runs, but only with XDG_RUNTIME_DIR set — even –version aborts without it
check	hyprlock has a config, without which it exits instead of locking
check	the session launcher execs Hyprland rather than backgrounding it
check	the launcher waits for the parent socket instead of sleeping — Hyprland aborts if it is absent
check	the wl: verb’s wlroots tooling is installed — each verb fails on a MISSING BINARY without it
check	the Lua config targets WAYLAND-1, the nested output name
check	the Lua config grants grim screencopy — enforce_permissions denies it per binary otherwise
check	vfr sits under debug: — it moved out of misc: in Hyprland 0.55