Multiple Input Isolation

[uebian]

Is there an existing issue for this?

• I have searched the existing issues

Is your issue described in the documentation?

• I have read the documentation

Is your issue present in the latest beta/pre-release?

This issue is present in the latest pre-release

Describe the Bug

I started two instances of Sunshine in separate Docker containers on the same host machine. Each container is configured using the following docker-compose definition:

  test1:
    image: <a custom image based on Ubuntu 24.04>
    privileged: true
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              capabilities: [gpu]
    environment:
      - NVIDIA_DRIVER_CAPABILITIES=all
    volumes:
      - /dev/input/:/dev/input/:ro
    group_add:
      - render
    runtime: nvidia

The host is running LightDM as the display manager and XFCE4 as the desktop environment. systemd is started within each container.

Everything appears to function correctly except for one critical issue: input events are not isolated between the two containers. For example, moving the mouse or pressing a key in one container also generates corresponding input events in the other.

Upon investigation, I found that each Sunshine session creates multiple virtual input devices. Here's the output from xinput list inside one container:

root@test1:/home/ubuntu# xinput list
⎡ Virtual core pointer                    	id=2	[master pointer  (3)]
⎜   ↳ Virtual core XTEST pointer              	id=4	[slave  pointer  (2)]
⎜   ↳ Wolf mouse (abs) virtual device         	id=9	[slave  pointer  (2)]
⎜   ↳ Mouse passthrough                       	id=10	[slave  pointer  (2)]
⎜   ↳ Wolf mouse (abs) virtual device         	id=14	[slave  pointer  (2)]
⎜   ↳ Mouse passthrough                       	id=15	[slave  pointer  (2)]
⎣ Virtual core keyboard                   	id=3	[master keyboard (2)]
    ↳ Virtual core XTEST keyboard             	id=5	[slave  keyboard (3)]
    ↳ Keyboard passthrough                    	id=8	[slave  keyboard (3)]
    ↳ Power Button                            	id=7	[slave  keyboard (3)]
    ↳ Power Button                            	id=6	[slave  keyboard (3)]
    ↳ Keyboard passthrough                    	id=13	[slave  keyboard (3)]

And here's the list of input devices mounted inside the container:

root@test1:/home/ubuntu# ls /dev/input/
by-path  event0  event1  event10  event11  event12  event13  event14  event15  event16  event17  event2  event3  event4  event5  event6  event7  event8  event9  js0  js1  mice  mouse0  mouse1  mouse2  mouse3

It seems the containers are sharing input devices from the host, which results in overlapping input events across sessions. This behavior breaks the isolation between Sunshine instances and makes parallel usage problematic.

Expected Behavior

The input into the first sunshine instance will not have the impact on the second sunshine instance.

Additional Context

My Xorg configuration as listed below:

Section "ServerLayout"
    Identifier     "DummyLayout"
    Screen         "DummyScreen"
EndSection

Section "Monitor"
    Identifier     "DummyMonitor"
    HorizSync      28.0-80.0
    VertRefresh    48.0-75.0
EndSection

Section "Device"
    Identifier     "DummyDevice"
    Driver         "dummy"
    VideoRam       256000
EndSection

Section "Screen"
    Identifier     "DummyScreen"
    Device         "DummyDevice"
    Monitor        "DummyMonitor"
    DefaultDepth   24
    SubSection "Display"
        Depth      24
        Modes      "1920x1080"
    EndSubSection
EndSection

Host Operating System

Docker

Operating System Version

docker-ce 28.0.4

Architecture

amd64/x86_64

Sunshine commit or version

v2025.122.141614

Package

Linux - deb

GPU Type

NVIDIA

GPU Model

NVIDIA RTX A6000

GPU Driver/Mesa Version

570.124.06

Capture Method

X11 (Linux)

Config

capture = x11

Apps

All

Relevant log output

Mar 29 19:27:40 ubuntu systemd[1]: Started sunshine.service - Sunshine.
Mar 29 19:27:40 ubuntu sunshine[437]: [capture] -- [x11]
Mar 29 19:27:40 ubuntu sunshine[437]: [2025-03-29 19:27:40.635]: Info: Sunshine version: v2025.122.141614
Mar 29 19:27:40 ubuntu sunshine[437]: [2025-03-29 19:27:40.635]: Info: Package Publisher: LizardByte
Mar 29 19:27:40 ubuntu sunshine[437]: [2025-03-29 19:27:40.635]: Info: Publisher Website: https://app.lizardbyte.dev
Mar 29 19:27:40 ubuntu sunshine[437]: [2025-03-29 19:27:40.635]: Info: Get support: https://app.lizardbyte.dev/support
Mar 29 19:27:40 ubuntu sunshine[437]: [2025-03-29 19:27:40.636]: Warning: Failed to create system tray
Mar 29 19:27:40 ubuntu sunshine[437]: [2025-03-29 19:27:40.656]: Info: Detecting displays
Mar 29 19:27:40 ubuntu sunshine[437]: [2025-03-29 19:27:40.765]: Info: Detected display: DUMMY0 (id: 0)DUMMY0 connected: true
Mar 29 19:27:40 ubuntu sunshine[437]: [2025-03-29 19:27:40.765]: Info: Detected display: DUMMY1 (id: 1)DUMMY1 connected: false
Mar 29 19:27:40 ubuntu sunshine[437]: [2025-03-29 19:27:40.765]: Info: Detected display: DUMMY2 (id: 2)DUMMY2 connected: false
Mar 29 19:27:40 ubuntu sunshine[437]: [2025-03-29 19:27:40.765]: Info: Detected display: DUMMY3 (id: 3)DUMMY3 connected: false
Mar 29 19:27:40 ubuntu sunshine[437]: [2025-03-29 19:27:40.765]: Info: Detected display: DUMMY4 (id: 4)DUMMY4 connected: false
Mar 29 19:27:40 ubuntu sunshine[437]: [2025-03-29 19:27:40.765]: Info: Detected display: DUMMY5 (id: 5)DUMMY5 connected: false
Mar 29 19:27:40 ubuntu sunshine[437]: [2025-03-29 19:27:40.765]: Info: Detected display: DUMMY6 (id: 6)DUMMY6 connected: false
Mar 29 19:27:40 ubuntu sunshine[437]: [2025-03-29 19:27:40.765]: Info: Detected display: DUMMY7 (id: 7)DUMMY7 connected: false
Mar 29 19:27:40 ubuntu sunshine[437]: [2025-03-29 19:27:40.765]: Info: Detected display: DUMMY8 (id: 8)DUMMY8 connected: false
Mar 29 19:27:40 ubuntu sunshine[437]: [2025-03-29 19:27:40.765]: Info: Detected display: DUMMY9 (id: 9)DUMMY9 connected: false
Mar 29 19:27:40 ubuntu sunshine[437]: [2025-03-29 19:27:40.765]: Info: Detected display: DUMMY10 (id: 10)DUMMY10 connected: false
Mar 29 19:27:40 ubuntu sunshine[437]: [2025-03-29 19:27:40.765]: Info: Detected display: DUMMY11 (id: 11)DUMMY11 connected: false
Mar 29 19:27:40 ubuntu sunshine[437]: [2025-03-29 19:27:40.766]: Info: Detected display: DUMMY12 (id: 12)DUMMY12 connected: false
Mar 29 19:27:40 ubuntu sunshine[437]: [2025-03-29 19:27:40.766]: Info: Detected display: DUMMY13 (id: 13)DUMMY13 connected: false
Mar 29 19:27:40 ubuntu sunshine[437]: [2025-03-29 19:27:40.766]: Info: Detected display: DUMMY14 (id: 14)DUMMY14 connected: false
Mar 29 19:27:40 ubuntu sunshine[437]: [2025-03-29 19:27:40.766]: Info: Detected display: DUMMY15 (id: 15)DUMMY15 connected: false
Mar 29 19:27:40 ubuntu sunshine[437]: [2025-03-29 19:27:40.855]: Info: // Testing for available encoders, this may generate errors. You can safely ignore those errors. //
Mar 29 19:27:40 ubuntu sunshine[437]: [2025-03-29 19:27:40.855]: Info: Trying encoder [nvenc]
Mar 29 19:27:40 ubuntu sunshine[437]: [2025-03-29 19:27:40.855]: Info: Screencasting with X11
Mar 29 19:27:40 ubuntu sunshine[437]: [2025-03-29 19:27:40.880]: Info: Creating encoder [h264_nvenc]
Mar 29 19:27:40 ubuntu sunshine[437]: [2025-03-29 19:27:40.880]: Info: Color coding: SDR (Rec. 601)
Mar 29 19:27:40 ubuntu sunshine[437]: [2025-03-29 19:27:40.880]: Info: Color depth: 8-bit
Mar 29 19:27:40 ubuntu sunshine[437]: [2025-03-29 19:27:40.880]: Info: Color range: JPEG
Mar 29 19:27:41 ubuntu sunshine[437]: [2025-03-29 19:27:41.344]: Info: Creating encoder [hevc_nvenc]
Mar 29 19:27:41 ubuntu sunshine[437]: [2025-03-29 19:27:41.344]: Info: Color coding: SDR (Rec. 601)
Mar 29 19:27:41 ubuntu sunshine[437]: [2025-03-29 19:27:41.344]: Info: Color depth: 8-bit
Mar 29 19:27:41 ubuntu sunshine[437]: [2025-03-29 19:27:41.344]: Info: Color range: JPEG
Mar 29 19:27:41 ubuntu sunshine[437]: [2025-03-29 19:27:41.608]: Info: Creating encoder [av1_nvenc]
Mar 29 19:27:41 ubuntu sunshine[437]: [2025-03-29 19:27:41.609]: Info: Color coding: SDR (Rec. 601)
Mar 29 19:27:41 ubuntu sunshine[437]: [2025-03-29 19:27:41.609]: Info: Color depth: 8-bit
Mar 29 19:27:41 ubuntu sunshine[437]: [2025-03-29 19:27:41.609]: Info: Color range: JPEG
Mar 29 19:27:41 ubuntu sunshine[437]: [2025-03-29 19:27:41.615]: Warning: [av1_nvenc @ 0x55e465482d00] Codec not supported
Mar 29 19:27:41 ubuntu sunshine[437]: [2025-03-29 19:27:41.615]: Error: [av1_nvenc @ 0x55e465482d00] Provided device doesn't support required NVENC features
Mar 29 19:27:41 ubuntu sunshine[437]: [2025-03-29 19:27:41.865]: Error: Could not open codec [av1_nvenc]: Function not implemented
Mar 29 19:27:41 ubuntu sunshine[437]: [2025-03-29 19:27:41.865]: Info: Screencasting with X11
Mar 29 19:27:41 ubuntu sunshine[437]: [2025-03-29 19:27:41.866]: Info: Creating encoder [hevc_nvenc]
Mar 29 19:27:41 ubuntu sunshine[437]: [2025-03-29 19:27:41.866]: Info: Color coding: SDR (Rec. 709)
Mar 29 19:27:41 ubuntu sunshine[437]: [2025-03-29 19:27:41.866]: Info: Color depth: 10-bit
Mar 29 19:27:41 ubuntu sunshine[437]: [2025-03-29 19:27:41.866]: Info: Color range: JPEG
Mar 29 19:27:41 ubuntu sunshine[437]: [2025-03-29 19:27:41.885]: Error: cuda::cuda_t doesn't support any format other than AV_PIX_FMT_NV12
Mar 29 19:27:42 ubuntu sunshine[437]: [2025-03-29 19:27:42.127]: Info:
Mar 29 19:27:42 ubuntu sunshine[437]: [2025-03-29 19:27:42.127]: Info: // Ignore any errors mentioned above, they are not relevant. //
Mar 29 19:27:42 ubuntu sunshine[437]: [2025-03-29 19:27:42.127]: Info:
Mar 29 19:27:42 ubuntu sunshine[437]: [2025-03-29 19:27:42.127]: Info: Found H.264 encoder: h264_nvenc [nvenc]
Mar 29 19:27:42 ubuntu sunshine[437]: [2025-03-29 19:27:42.127]: Info: Found HEVC encoder: hevc_nvenc [nvenc]
Mar 29 19:27:42 ubuntu sunshine[437]: [2025-03-29 19:27:42.128]: Info: Adding avahi service ubuntu
Mar 29 19:27:42 ubuntu sunshine[437]: [2025-03-29 19:27:42.130]: Info: Configuration UI available at [https://localhost:47990]
Mar 29 19:27:43 ubuntu sunshine[437]: [2025-03-29 19:27:43.021]: Info: Avahi service ubuntu successfully established.

[XT-Martinez]

I think this is to be expected given how inputtino works.
I have found a project that achieved virtual device input isolation

https://games-on-whales.github.io/wolf/stable/dev/fake-udev.html

It involves creating udev rules to ignore virtual devices on the host and then faking the udev events inside the container.

[LizardByte-bot]

It seems this issue hasn't had any activity in the past 90 days. If it's still something you'd like addressed, please let us know by leaving a comment. Otherwise, to help keep our backlog tidy, we'll be closing this issue in 10 days. Thanks!

[LizardByte-bot]

This issue was closed because it has been stalled for 10 days with no activity.

[joleuger]

Hey 👋,

I’ve been working on a small project that directly addresses the exact problem you’re describing — input isolation when running multiple Sunshine instances in containers.

Normally, when /dev/uinput is bind-mounted into containers, all instances share the same kernel-level uinput interface. That means devices created in one container are visible system-wide (and thus to other containers), so input events leak across instances — exactly like what you’re seeing.

My project vuinputd
is a CUSE-based proxy for /dev/uinput.
It lets unmodified applications like Sunshine create virtual input devices inside containers, while the actual device creation happens safely on the host.
Each container gets its own mediated /dev/uinput, and vuinputd ensures:

🧩 Devices from one container don’t leak into others

🔒 The host ignores those devices (via udev isolation)

🎮 SDL2 / Wayland apps inside the container still see proper udev events

It currently works with systemd-nspawn, but the design also applies to Docker, LXC, and other runtimes — no kernel patches or special drivers needed.

If you’re experimenting with multi-instance Sunshine or containerized GPU game streaming, this approach could solve your input collision issue.
The project is still in an early prototype stage, but it’s functional — you can find the details here:
👉 https://github.com/joleuger/vuinputd

[ReenigneArcher]

@joleuger Sounds awesome. Once you feel it's a little more stable feel free to add it to https://github.com/LizardByte/awesome-sunshine

[mwatola-glitch]

Adding a concrete two-instance case and a working (if hacky) workaround, in case it helps others hitting this.

Setup: two Sunshine instances on one Linux host - one streaming my KDE/seat0 desktop, and one as a headless per-user session (headless sway + its own Sunshine) for a second user. Goal: use the physical desktop while the second user streams, with no input crosstalk.

Root cause (for this case): the virtual uinput devices (created via inputtino) have identical hardcoded identifiers - 0xBEEF:0xDEAD, names Mouse passthrough / Keyboard passthrough, empty phys/uniq. Both compositors on the single seat0 enumerate all of them, so one client's input drives the other desktop. Because the devices are byte-identical, no udev rule can tell one instance's devices from the other's, and simply moving devices off seat0 also hides them from the headless sway (its libinput enumerates seat0), so that breaks the streaming session too.

What actually worked (workaround):

1. LD_PRELOAD shim on the second instance that intercepts ioctl(UI_DEV_SETUP) and rewrites id.vendor 0xBEEF -> 0xF00D, making that instance's devices distinguishable.
   • Gotcha: /usr/bin/sunshine carries cap_sys_admin,cap_sys_nice (for KMS capture) -> the process runs AT_SECURE -> LD_PRELOAD is ignored. The second instance uses capture = wlr and does not need caps, so I run a non-capped copy of the binary for it.
2. Point that instance's headless sway input config at the new id (0xF00D) so sway still enables its devices.
3. On the desktop compositor (KWin), disable only the 0xF00D devices (~/.config/kcminputrc -> [Libinput][61453][57005][<name>] Enabled=false). The other instance's 0xBEEF devices stay enabled, so remote control of that desktop keeps working.

Result: fully independent cursors - each user's input stays inside their own session, both directions.

The clean fix would be to make the uinput device VID/PID/name configurable (in inputtino, surfaced via Sunshine config), defaulting to the current values. Then a second instance just gets a distinct VID and everything above collapses to a single udev rule or one per-device compositor setting - no shim, no binary copy. I opened a feature request for that here: games-on-whales/inputtino#45.

[ReenigneArcher]

@mwatola-glitch I'm actually working on moving input over to https://github.com/LizardByte/libvirtualhid in #5368

The goal is to have a single input library between all platforms. So far I have tested on Windows and it seems to be working fairly well. Going to be testing Linux in the coming days, but I suspect it will work without too much more adjustment.

With that said, I don't know if it will handle this issue as is. A PR would be welcome, otherwise I think there's already a feature request here: https://github.com/orgs/LizardByte/discussions/868

[mwatola-glitch]

Thanks @ReenigneArcher - that's great news, a single cross-platform input library is exactly the right home for this.

Nice thing: libvirtualhid's DeviceProfile already carries vendor_id / product_id / name (src/include/libvirtualhid/types.hpp), so the mechanism to distinguish devices per instance is essentially already there. For the multi-instance isolation case (this issue and #868), the remaining piece looks like just letting Sunshine set a distinct VID/PID (or name) per instance via config and passing it into the Create*Options when it creates the virtual devices - defaulting to the current values for backward compatibility.

Once instances have distinct IDs, isolation collapses to a plain udev ID_SEAT rule or a per-device compositor setting - no hacks. (Today I worked around it on the current inputtino path with an LD_PRELOAD shim that rewrites the vendor 0xBEEF -> 0xF00D on one instance, then disables just that vendor in KWin. Works, but a config option would obviously be much cleaner.)

Happy to contribute the Sunshine-side config wiring once #5368 settles on Linux - just let me know whether you'd prefer it folded into #5368 or as a follow-up PR. I'll leave games-on-whales/inputtino#45 open for the Wolf/inputtino path.

[ReenigneArcher]

@mwatola-glitch if you could make a PR into 5368 I think that would be ideal, otherwise I'm okay with waiting until after it merges.