Duo 1.5.0 is now available (with proper sandbox support)

Consider this a late New-Year's Eve update

I originally hoped to have all of this ready for New Year’s Eve, but debugging took way longer than expected.

A lot of this post will focus on this update's new and improved sandbox support, but you'll find that this is just as much a bug-fix update as it is a feature update.

And yes, I've been hammering away at this, on and off, since October 16th...

It really shows you how much work goes into these passion projects.

Either way. Let’s start with a primer for the uninitiated, explaining what Duo does, before diving into the pros and cons of sandboxing with Duo 1.5.0 and onward.

What is Duo?

Duo is my take on multiseated computing and video game streaming, built around Sunshine, Moonlight, and several custom userspace drivers and services.

Its biggest differentiator, compared to a regular Sunshine + Moonlight setup, is its ability to support multiple separate users on a single computer, with each user having their own independent environment.

Essentially, it allows you to split a single computer into multiple virtual systems, enabling multiple users to stream software and games simultaneously.

Duo's Achilles' Heel: The Segregation Dilemma

Most of Duo’s original issues have been ironed out over countless updates, but the issue of segregation between clients remains a recurring challenge, especially with host-connected Bluetooth input devices.

If I had to explain it in layman's terms, its the issue of certain resources, like input devices, not being assigned to the right user or any user at all.

Without delving too deeply into why this issue exists, the root cause lies in the way Microsoft certifies kernel drivers. Anti-Cheat systems in certain games compound the problem by preventing the deployment of custom kernel-level filter drivers that don’t meet those very same certification requirements.

This issue has persisted since Windows 10 version 1607, and while there’s no universal solution accessible to us yet, there’s still room for improvement on our end, even without access to custom kernel-level filter drivers.

Fun fact: Duo isn’t the only software affected by this. Many other tools, like Handheld Companion, DS4Windows, and virtually any software that uses HidHide, encounter similar challenges. Particularly with Bluetooth peripherals.

Solving the Segregation Issue: Enter Sandbox Support

A sandboxed instance is, for all intents and purposes, a separate virtual computer. However, unlike virtual machines, a sandbox requires significantly less storage space.

To put this into perspective, a typical Windows virtual machine consumes about 30GB of storage, while a sandbox can require as little as 400MB.

Additional benefits of sandboxed instances include:

• Automatic updates: Sandboxes update along with the host system, eliminating the need for separate updates.

• Isolation: Sandboxes isolate themselves from the host system, granting each instance its own global namespace with separate thread primitives, kernel objects, and, most importantly, a distinct device pool.

This isolation eliminates the need for Duo to manually segregate devices by setting their session ID device property, effectively solving the segregation issue without requiring a custom kernel-level filter driver.

Another major advantage is the ability to run multiple instances of software like Steam or other global-exclusive applications, thanks to the unique global namespace provided by sandboxes.

The Cons of Sandboxed Instances

While sandboxing offers significant benefits, there are some drawbacks:

• Performance impact: Sandboxed instances exhibit a noticeable performance hit compared to native counterparts due to their virtualized nature.

• Compatibility issues: Some Anti-Cheat systems don’t cooperate well with virtualized hardware.

• Registry separation: Sandboxes don’t share a common registry with the host system, meaning some pre-installed software won’t be accessible unless installed separately in the sandbox.

To address this last issue, Duo selectively synchronizes specific registry subkeys with the sandbox, effectively passing through host-installed software for seamless use. Duo 1.5.0 already handles this for Steam and Epic Games, with plans to extend support to additional storefronts and software in future updates.

Another Tool in the Belt

While sandboxing isn’t a universal solution to every issue, it addresses several previously unsolvable problems, albeit with some manageable trade-offs.

To clarify, sandboxing is entirely optional and can be enabled or disabled for individual instances via the Duo Manager application. Consider it another tool at your disposal to use when needed.

Looking Ahead: Sandbox Improvements, Custom Filter Drivers, and better HDR Support

There's three key points I want to spend more time on in the future:

• Custom filter drivers: I’m attempting to gain access to Microsoft’s hardware dashboard through a signing conclave. If successful, this could allow me to resolve the segregation issue for native instances without relying on workarounds.

• Enhanced sandboxing: I aim to improve Duo’s sandbox implementation to further streamline software passthrough capabilities, minimizing friction for end-users. My long-goal is to make sandboxing as simple as ticking a checkbox, with no additional configuration required.

• Improved HDR detection support: Currently, not all HDR-compatible software correctly detects HDR when used with Duo. This is a known issue that I am actively investigating and working on to ensure a seamless HDR experience. This issue is deeply linked to the segregation issue, as our biggest problem here isn't actually fixing it, but fixing it in a way that Anti-Cheat systems don't get offended.

Getting Duo

All builds of Duo, dating back to the initial release, can be found in it's original release post.

A reduced-functionality build can be freely downloaded from Duo's GitHub page as well.

Consider it a freely available demo that should be sufficiently featured for most casual people's needs.

Additionally, GitHub builds can be used to upgrade Patreon builds at no cost, letting you maintain the full feature set without requiring a long-term subscription.

Building Cool Stuff Together

I love creating cool projects like Duo for all of you and don’t want anyone to feel pressured to contribute more than they’re able.

I’m incredibly grateful for your support, as it enables me to pursue these passion projects. However, I completely understand that not everyone is in a position to contribute financially.

Give only what you can and are comfortable with. Your support, no matter the form, means the world to me.

See you in the next post!

- Black-Seraph