5 ms·

Yes. The sandbox tool used by Flatpak is "bubblewrap", which has an overview here: https://github.com/projectatomic/bubblewrap/blob/master/README.md#user-namesp

Yes. The sandbox tool used by Flatpak is "bubblewrap", which has an overview here: https://github.com/projectatomic/bubblewrap/blob/master/README.md#user-namespaces https://github.com/projectatomic/bubblewrap/blob/master/READ... There is nothing against Flatpak using user namepsaces when the developers feel a bit more comfortable with that, though.

lvh 8y ago
Are you one of the developers/speaking for them? That warning is pretty old.
- cyphar 8y ago
  Creation of user namespaces still has caused security vulnerabilities in very recent history. But with seccomp you can disable it inside a container (which is what Docker and LXC do by default for instance), and it doesn't make sense to be worried about that as a container runtime because you are using it to increase the security of your sandbox.
cyphar 8y ago
Bubblewrap supports user namespaces and has for a while -- grep through the source for CLONE_NEWUSER. I talk about the security concerns a bit in [1]. [1]: https://news.ycombinator.com/item?id=18181034 https://news.ycombinator.com/item?id=18181034