>Linux containers on a read only FS Not really - the child program could realize that it's on a read-only FS. But with FSSB, this is actually hidden - the prog

>Linux containers on a read only FS Not really - the child program could realize that it's on a read-only FS. But with FSSB, this is actually hidden - the program thinks it's on a regular FS (although I've recently learned that there are more advanced ways to even break this). >some similar preload intercept This is slightly more performant (of course, not as fast as a program without ptrace intercepts). >Use a real virtual machine instead please This is obviously not a full-fledged security suite ;) Just a simple, lightweight sandbox. Also this is in alpha.