[RFC] Manifest v3: D-Bus scoping, BinderFS delegation, and declarative firewall backend for nested containers

On declarative OS like NixOS, Waydroid is a pain because it mutates host state imperatively: waydroid init downloads blobs into /var/lib/waydroid, waydroid-net.sh injects iptables/nftables rules on the fly, and the session service grabs arbitrary D-Bus names. cpak already solves the OverlayFS/content-addressed part. What is missing are three manifest primitives to let cpak manage the lifecycle of privileged nested runtimes (Waydroid, Steam PressureVessel, etc.) without the workload touching host state directly.
Steam PoC: D-Bus is the current blocker
Tested Steam inside cpak on NixOS (Wayland/Niri, AMD 780M RADV). GPU pass-through and Wayland socket forwarding work. What fails:
(zenity:311): Gdk-WARNING **: Cannot list activatable names: GDBus.Error:org.freedesktop.DBus.Error.AccessDenied: session bus access is not permitted
steam-runtime-launcher-service[1386]: E: Unable to acquire bus name "com.steampowered.PressureVessel.LaunchAlongsideSteam"

Steam acquires custom session bus names inside its own proxy. cpak's D-Bus proxy currently blocks this. Same pattern applies to Waydroid's org.waydroid.* session names.
Kernel baseline (no edge cases, just facts)
binderfs merged in Linux 5.0 (2019). Present in all stock kernels ≥5.7.
ashmem deprecated since Linux 5.18; Waydroid uses memfd. No extra kernel modules needed on recent kernels.
iptables legacy modules (ip_tables) are increasingly absent on kernels ≥6.17. NixOS already switched Waydroid to an nftables backend (waydroid-nftables) in nixpkgs PR #466473.
This means cpak cannot assume iptables is available. The manifest must declare the expected firewall backend.

Proposed Manifest v3 additions

A. Scoped D-Bus name ownership (ownSessionNames)
Allow the manifest to request specific bus name patterns on cpak's private D-Bus proxy, instead of exposing the raw host socket:
"override": {
  "dbus": {
    "ownSessionNames": [
      "com.steampowered.PressureVessel.*",
      "org.waydroid.*"
    ]
  }
}

This is the Flatpak --own-name model, adapted to cpak's proxy architecture.
B. BinderFS device delegation
Waydroid needs /dev/binderfs/binder, /dev/binderfs/hwbinder, /dev/binderfs/vndbinder. A manifest flag lets System Authority bind-mount or delegate these nodes into the container:
"override": {
  "devices": {
    "binderfs": true
  }
}

Assumes the host kernel already exposes binderfs (true for Linux ≥5.0). No DKMS, no custom kernels — stock kernel is sufficient.
C. Declarative firewall backend
Replace imperative waydroid-net.sh with a manifest-declared backend. System Authority sets up NAT/forwarding/masquerade using the correct tool:
"override": {
  "network": {
    "firewallBackend": "nftables",
    "forwardPorts": [53, 67],
    "masqueradeSubnet": "192.168.240.0/24"
  }
}

Supported values: "iptables", "nftables", "none". cpak picks the backend that matches the host kernel capabilities.

D. OCI flavor tags (future)
waydroid init -s GAPPS is imperative state. If cpak supports OCI-tagged rootfs images, this becomes:
cpak install github.com/containerpak/waydroid:vanilla-latest
cpak install github.com/containerpak/waydroid:gapps-android13

Zero post-install scripts, rollback via layer hash.
Minor: cursor theme forwarding
GTK/Wayland apps inside cpak fall back to default cursors. Forward XCURSOR_THEME, XCURSOR_SIZE, and mount host icon paths (~/.icons, /usr/share/icons) to match host UX.

Environment

OS: NixOS 26.11 (Zokor) x86_64
Compositor: Niri (Wayland)
GPU: AMD Radeon 780M (RADV Mesa 26.0.3)
Kernel: Linux 7.1.10-zen1
cpak: v2.11.2 (Flake module)