overthinkos/sway
ov-selkies/skills/sway/SKILL.md
Sway Wayland compositor running headless inside containers with Mesa GPU drivers. Use when working with Sway, Wayland desktop, or headless compositor setup.
data-ai
Updated May 10, 2026
$ install --global
skillsauthnpx skillsauth add overthinkos/overthink-plugins swayInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 10, 2026, 5:42 AM167.8s1 file scanned
SKILL.md
- name:
- sway
- description:
- |
sway -- Headless Wayland compositor
Layer Properties
| Property | Value |
|----------|-------|
| Dependencies | dbus |
| Service | sway (supervisord, priority 10) |
| Install files | tasks:, config, sway-wrapper |
Environment Variables
| Variable | Value |
|----------|-------|
| WLR_BACKENDS | headless (supervisord env) |
| WLR_HEADLESS_OUTPUTS | 1 |
| WLR_LIBINPUT_NO_DEVICES | 1 |
| XDG_RUNTIME_DIR | /tmp |
| WAYLAND_DISPLAY | wayland-0 |
| EGL_LOG_LEVEL | fatal |
| XKB_DEFAULT_LAYOUT | us |
Keyboard Configuration
Keyboard layout defaults to US. Override with env_accepts vars:
| Variable | Default | Purpose |
|----------|---------|---------|
| XKB_DEFAULT_LAYOUT | us | Keyboard layout (us, de, fr, gb, etc.) |
| XKB_DEFAULT_VARIANT | (empty) | Layout variant (dvorak, nodeadkeys, etc.) |
ov config sway-desktop -e XKB_DEFAULT_LAYOUT=de
Sway reads XKB_DEFAULT_LAYOUT natively from the environment — no wrapper change needed. See /ov-selkies:labwc for full XKB var list (MODEL, OPTIONS).
The supervisord [program:sway] environment sets WLR_BACKENDS=headless — headless output only. The libinput backend is not included by default because it requires a libseat session which fails in rootless containers.
Packages
sway,fuzzel(RPM)mesa-dri-drivers,mesa-vulkan-drivers(RPM)libglvnd-egl,libglvnd-gles,egl-wayland(RPM)wlr-randr(RPM)
Usage
# image.yml -- typically not used directly; pulled in via chrome-sway
my-desktop:
layers:
- sway
XWayland
XWayland is enabled by default (xwayland enable in the base config). The xorg-x11-server-Xwayland package is included in the sway layer. XWayland starts lazily — the Xwayland process only launches when the first X11 client connects (e.g., Steam, Heroic, Qt apps with xcb platform).
X11 tools for interacting with XWayland windows (xdotool, xprop, xwininfo, import) are provided by the /ov-selkies:wl-tools layer.
Stale IPC Socket Cleanup
Supervisord restarts leave old /tmp/sway-ipc.1000.<old-pid>.sock files. If multiple sockets exist, naive discovery (ls /tmp/sway-ipc.*.sock | head -1) picks alphabetically -- which selects the smallest PID (oldest = stale socket), causing ov eval wl sway commands to fail silently.
Fix: sway-wrapper cleans old sockets before starting Sway. Both sway-wrapper and ov eval wl sway (sway.go) use ls -t | head -1 (newest modification time first) when discovering the active socket.
Symptoms of stale socket: ov eval wl sway commands fail, resolution stays at 1280x720 (wlr-randr resize fails), Chrome renders at wrong size.
NVIDIA Headless: Renderer
By default, sway-wrapper auto-detects GPU hardware and uses gles2 on NVIDIA. However, if WLR_RENDERER is pre-set (e.g., by a composing layer), the wrapper skips GPU auto-detection entirely and uses the specified renderer.
- VNC images (
sway-desktop-vnc) override topixman(software rendering) — ensures reliable VNC screenshot capture on NVIDIA headless - Non-VNC images (Sunshine, standalone sway) use
gles2via auto-detection — Chrome gets full GPU acceleration grim(ov eval wl screenshot) works with both renderers
Used In Images
Transitive dependency via chrome-sway and sway-desktop in all desktop images.
Related Layers
/ov-foundation:dbus-- D-Bus session bus dependency/ov-selkies:chrome-sway-- Chrome on Sway (depends on sway)/ov-selkies:sway-desktop-- full desktop composition (VNC)/ov-selkies:wayvnc-- VNC access to Sway display/ov-selkies:waybar-- status bar (depends on sway)
Related Commands
/ov-advanced:wl— Wayland desktop automation (screenshot, input, windows, clipboard, AT-SPI2)
When to Use This Skill
Use when the user asks about:
- Sway compositor configuration
- Headless Wayland setup
WLR_BACKENDSor Wayland environment variables- Mesa GPU driver configuration
- Desktop compositor in containers
Related
/ov-build:layer— layer authoring reference (layer.ymlschema, task verbs, service declarations)/ov-build:eval— declarative testing (eval:block,ov eval image,ov eval live)
Related Skills
overthinkos/plugin
tools
VerifiedTrustedCommunity
Use when authoring or modifying a charly PLUGIN — a candy with a `plugin:` block that contributes Providers (verbs/kinds/deploy-targets/steps/builders/commands), its own CUE schema, builtin (compiled-in) or external (out-of-tree git repo). Covers the unified Provider model, the per-plugin CUE-schema contract (single source → Go params for dev + schema-over-Describe RPC for runtime), the SDK, and the loader.
SKILL.mdUpdated Jun 22, 2026
overthinkos/cue
tools
VerifiedTrustedCommunity
The CUE data-validation / configuration CLI (cue), pinned to v0.16.1. Use when working with the cue candy, installing the cue binary into a box or onto a target:local dev host, or running the offline schema-vendoring pipeline that feeds charly's egress validation.
SKILL.mdUpdated Jun 16, 2026
overthinkos/egress
tools
VerifiedTrustedCommunity
CUE EGRESS validation — validating (and, where it adds value, generating) the config files charly WRITES to a system BEFORE the bytes hit disk. MUST be invoked before working on charly/egress.go, the vendored schemas under candy/plugin-egress/egress-schemas/vendor/, the ValidateEgress / registerVendoredEgressKind path, the offline `task cue:vendor` pipeline, or adding an egress schema for any written artifact (cloud-init, k8s manifests, traefik routes, runtime config, install ledger, systemd/quadlet units, ssh_config, libvirt XML).
SKILL.mdUpdated Jun 16, 2026
overthinkos/check-k8s
tools
VerifiedTrustedCommunity
Kubernetes cluster-probe declarative check verb — the `kube:` check verb (nodes, pods, ingress, storage class, addon health, apply/delete, and arbitrary resource GETs) served out-of-process by the candy/plugin-kube plugin (vendored client-go; no external kubectl required).
SKILL.mdUpdated Jun 14, 2026