Turn off Winboat container and do some sandboxing

system/winboat.sh

@@ -0,0 +1,42 @@
+#!/bin/bash
+#
+# Purpose : Keep WinBoat's Windows container from starting at boot. Run by
+#           install.sh and on every update (updates.d/75-winboat.sh).
+#
+# WinBoat's "Auto Start Container" setting is the restart policy in its
+# docker-compose.yml, which WinBoat applies to the container. A container that
+# restarts on its own runs Windows (8 GB of RAM and 4 cores by default) from
+# boot until you stop it, whether or not you use WinBoat. This sets the policy
+# back to "no" in the compose file and on the container, which doesn't need
+# recreating. WinBoat starts the container when you open it, as before.
+
+WINBOAT="$HOME/.winboat"
+COMPOSE="$WINBOAT/docker-compose.yml"
+CONTAINER="WinBoat"
+
+# Not set up yet: WinBoat writes these when you first install Windows with it
+[ -f "$COMPOSE" ] || exit 0
+
+STATUS=0
+
+# restart: no, as WinBoat writes it when the setting is off
+if grep -qE '^[[:space:]]*restart:' "$COMPOSE" \
+    && ! grep -qE "^[[:space:]]*restart:[[:space:]]*[\"']?no[\"']?[[:space:]]*$" "$COMPOSE"; then
+  echo "Turning off WinBoat's Auto Start Container..."
+  sed -i -E 's/^([[:space:]]*restart:).*/\1 no/' "$COMPOSE" || STATUS=1
+fi
+
+# WinBoat uses Docker unless you chose Podman in its settings
+runtime="$(jq -r '.containerRuntime // "Docker"' "$WINBOAT/winboat.config.json" 2> /dev/null)"
+runtime="$(tr '[:upper:]' '[:lower:]' <<< "${runtime:-docker}")"
+command -v "$runtime" > /dev/null || exit $STATUS
+
+# The container's own policy, or nothing if it doesn't exist or the runtime
+# isn't running (then the compose file applies the next time it's created)
+policy="$("$runtime" inspect -f '{{.HostConfig.RestartPolicy.Name}}' "$CONTAINER" 2> /dev/null)"
+if [ -n "$policy" ] && [ "$policy" != "no" ]; then
+  echo "Keeping WinBoat's Windows container from starting at boot..."
+  "$runtime" update --restart=no "$CONTAINER" > /dev/null || STATUS=1
+fi
+
+exit $STATUS