4 ms·
I just spent a few days trying to navigate all this. Perhaps some one here could enlighten me. If I just want to download some semi-trusted source code. And Co
by CuriousSkeptic 8y ago
I just spent a few days trying to navigate all this. Perhaps some one here could enlighten me.
If I just want to download some semi-trusted source code. And Configure; make; run; it in an environment where it can’t access anything unless I explicitly white list it (in particular, it should not be allowed to access the internet or any network resources, but I should be able to send http requests to it)
Which variant of all these container stuff would make things simplest to set up?
Docker seems way overkill (and seems to have the wrong defaults for this need anyways) but handcrafting things with iptables or ip netns seems a bit to low level. (And, well, not “contained”... I would prefer something declarative with automatic setup/teardown)
Ubuntu snaps looks like an interesting middle ground. But it also looks completely dead.
Any tips?
Edit: should probably rtfa before asking. it actually looks like a good fit ;)
- sjellis 8y agoIf you want the portability of Docker/OCI images without running a service etc., you might take a look at Buildah: https://www.projectatomic.io/blog/2017/06/introducing-buildah/ https://www.projectatomic.io/blog/2017/06/introducing-builda... It's a command-line tool for building and running container images.
- 112233 8y agoNot a container, but IF you manage to get Qubes running, it's really easy to create temp VM off fedora or debian that cannot access your other stuffs. You can even swap distro from under your homedir later.
- mongol 8y agoI think the systemd containerization features are worthwhile to explore. Both portable services and nspawn. They will be around on most Linux systems "out of the box" which is a big benefit. It will be like bash, maybe not the best shell, but the one that is around and that you can count on.
- leni536 8y agoFirejail could be a good fit.