Sunshine host security and capture

Scope

Sunshine is a self-hosted streaming server for Moonlight clients. It captures the host session, encodes video/audio, accepts paired-client input, and exposes an administration interface.

Trust boundary

The host can expose the screen, sound, applications, credentials, network listener, paired-client list, and remote keyboard/controller input. Treat its web UI as an administrative interface, not a harmless media page.

Do not expose Sunshine broadly before changing credentials, verifying the bind/firewall path, pairing only known clients, and documenting how to revoke them.

Supported installation

Follow the current upstream package table and prefer a distribution-specific package. Upstream says its AppImage cannot use KMS capture. On SteamOS, verify whether the package can capture the exact Desktop or Gaming Mode session before enabling autostart.

Verification

On a trusted LAN, confirm web credentials, host version, capture backend, display, encoder, codec, resolution, FPS, audio, and paired client. Measure host encode, network, client decode, frame pacing, and input separately.

Update

Update through the original package channel. Review configuration and security changes, retest capture after GPU/driver/session updates, and retain an alternate local control path before changing autostart.

Uninstall

Revoke clients, stop and disable Sunshine, remove any autostart/service entry through its documented method, restore firewall rules, then uninstall through the original package. Preserve configuration only if it is intentionally backed up and protected.

Rollback

Return to the previous package/configuration, restore the original capture backend and encoder, revoke new pairings, and confirm no listener remains when the host is meant to be disabled.

Recommended use

Use Sunshine when you control the host and need a Moonlight-compatible stream with measurable capture/encode behavior. Use Steam Remote Play when its integrated trust and controller workflow meets the requirement.

Frequently asked questions

Is installing Sunshine enough to stream Gaming Mode?
Is installing Sunshine enough to stream Gaming Mode?
No. Capture depends on session ownership, KMS/desktop path, permissions, GPU encoder, and package format. Upstream notes that its AppImage does not support KMS capture.
Should I forward Sunshine ports directly to the Internet?
Should I forward Sunshine ports directly to the Internet?
Not as a default recipe. Start on a trusted local network, use strong credentials and pairing, minimize exposure, and prefer a reviewed secure remote-access design.

Sources

Version history

  • 2026-07-15: Phase 6 host, capture, credential, network, revocation, and rollback review.