2 ms·
Um, yes it will? Linux namespeaces are linux namespaces; if you don't trust them we have bigger problems than Nix. It will certainly make sure the skids cannot
by Ericson2314 7y ago
Um, yes it will? Linux namespeaces are linux namespaces; if you don't trust them we have bigger problems than Nix.
It will certainly make sure the skids cannot do `#include </etc/password>` and get useful information, for example.
- soraminazuki 7y agoThat only works if you can turn your entire web application into a Nix build process, which is unrealistic at best. Nix is wonderful as a build tool, but it's quite a stretch to assume it's adequate for securing running applications. Plain containers, or even better, VMs are more suited for that purpose.
- Ericson2314 7y agoYour unsandboxed web application can perform a sandboxed nix build based on user input used in a very specific way. This contains the dangerous bit.