3 ms·
If the application is trustworthy, it doesn't matter. If not, you should think twice about running it even in a container.
by beojan 8y ago
If the application is trustworthy, it doesn't matter. If not, you should think twice about running it even in a container.
- cookiecaper 8y agoTo be clear, I agree. Containers on Linux are very weak security boundaries and should not be considered safe sandboxes for untrusted or dangerous code. In fact, post-Spectre, only physically independent hardware unattached to the network should be considered a reasonably safe sandbox. However, something is better than nothing, and it's just not true that there's no difference between running something from the AUR and running something in a "confined" snap. There is some crap in the way at least.
- beojan 8y agoGood point. Though the fact that you read your PKGBUILDs before running them (you do read your PKGBUILDs, right?) at least compensates for this.