3 ms·
I'm confused about what exactly 'sandboxing' entails here. Seems to be limiting syscalls and file system interactions. But what about process heap and cpu usage
by marktangotango 10y ago
I'm confused about what exactly 'sandboxing' entails here. Seems to be limiting syscalls and file system interactions. But what about process heap and cpu usage? Are these handled by either seccomp or capsicum?
- loeg 10y agoNo, capsicum is a security sandbox. Resource usage is not governed by capsicum. For that you can use traditional ulimits or RCTL for finer-grained control (similar to Linux cgroups).