I really like the simplicity and small size of the Appimage, but I don’t like that it has access to everywhere on my filesystem, so I created a bubblewrap script to sandbox the launcher:
This script is for Fedora KDE 44, but will likely work for most distros out there. Put the Epic Games Launcher Appimage into your home/Games folder, or edit the script accordingly.
#!/usr/bin/env bash
set -euxo pipefail
# Users home folder as the location is used many times
uHome="$HOME"
# path to the app I wish to run
APPIMAGE="$uHome/Games/EpicGamesLauncher-x86_64.AppImage"
# Make sure the needed directories exist, create them if not present:
mkdir -p "$uHome/.cache/com.epicgames.eglv2" "$uHome/.config/Epic" "$uHome/.local/share/com.epicgames.eglv2" "$uHome/.cache/mesa_shader_cache/"
# the huge brwap command - I think this is all of the folders that EGL requires, until it is updated anyway!!!
bwrap \
--proc /proc \
--dev-bind /dev /dev \
--bind /run/user/$(id -u){,} \
--bind /run/dbus{,} \
--tmpfs /tmp \
--ro-bind-try /usr{,} \
--ro-bind-try /lib{,} \
--ro-bind-try /lib64{,} \
--ro-bind-try /bin{,} \
--ro-bind-try /sbin{,} \
--ro-bind-try /sys{,} \
\
--dir /etc \
--ro-bind-try /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf \
--ro-bind-try /etc/crypto-policies/back-ends/opensslcnf.config{,} \
--ro-bind-try /etc/ca-certificates{,} \
--ro-bind-try /etc/fonts/{,} \
--ro-bind-try /etc/glvnd/egl_vendor.d{,} \
--ro-bind-try /etc/host.conf{,} \
--ro-bind-try /etc/hosts{,} \
--ro-bind-try /etc/ld.so.cache{,} \
--ro-bind-try /etc/localtime{,} \
--ro-bind-try /etc/machine-id{,} \
--ro-bind-try /etc/nsswitch.conf{,} \
--ro-bind-try /etc/os-release{,} \
--ro-bind-try /etc/pki{,} \
--ro-bind-try /etc/selinux/config{,} \
--ro-bind-try /etc/ssl{,} \
\
--bind-try "/mnt/more/games/Epic"{,} \
\
--bind "$uHome/Games"{,} \
--bind "$uHome/.cache/com.epicgames.eglv2"{,} \
--bind "$uHome/.local/share/com.epicgames.eglv2"{,} \
--bind "$uHome/.cache/mesa_shader_cache/"{,} \
--bind "$uHome/.config/Epic"{,} \
\
--bind-try "$uHome/.cache/fontconfig"{,} \
--bind-try "$uHome/.config/autostart"{,} \
--bind-try "$uHome/.config/fontconfig"{,} \
--bind-try "$uHome/.config/glib-2.0"{,} \
--bind-try "$uHome/.config/gtk-3.0"{,} \
--bind-try "$uHome/.config/mimeapps.list"{,} \
--bind-try "$uHome/.config/kdeglobals"{,} \
--bind-try "$uHome/.config/pulse"{,} \
--bind-try "$uHome/.local/share/applications"{,} \
--bind-try "$uHome/.local/share/icons"{,} \
--bind-try "$uHome/.local/share/vulkan"{,} \
--bind-try "$uHome/Desktop"{,} \
--bind-try "/opt/brave.com/brave"{,} \
"$APPIMAGE" --appimage-extract-and-run "$@"
I put this sh file beside the launcher appimage then created a shortcut for it.
Make sure to name your launcher ~/.local/share/applications/EpicGamesLauncher.desktop
and also include the line:
StartupWMClass=EpicGamesLauncher
so that you get the icon in your task manager.
I don’t know whether it would be worth putting this script up on my github or not. hat do you think?