4 ms·
> You can't really reproduce that with any popular desktop operating system. If you’re running Docker, you’re running Linux, and you can use the same kernel fe
by sjy 6y ago
> You can't really reproduce that with any popular desktop operating system.
If you’re running Docker, you’re running Linux, and you can use the same kernel features as Docker to sandbox applications yourself. This way, you only incur the overhead of a separate network namespace and filesystem if you actually need it. Services can be sandboxed with a few lines of configuration in a drop-in unit, and applications can be run with a shell script that calls `systemd-run`, just like the `docker run` shell scripts suggested in the article.
- remexre 6y agoDo you know of a tool that can do this for arbitrary programs? Maybe something like CARE [0] to find what the program should be accessing, then building the appropriate systemd configuration files? [0]: https://proot-me.github.io/care/ https://proot-me.github.io/care/
- jcelerier 6y ago> If you’re running Docker, you’re running Linux As slow as it is some people apparently enjoy running docker from win / mac
- mulmen 6y agoDocker needs Linux to work. On Mac/Windows containers run in a Linux virtual machine.
- slavik81 6y agoI thought so too, but apparently support for native Windows containers has existed for a while now. e.g. https://poweruser.blog/lightweight-windows-containers-using-docker-process-isolation-in-windows-10-62519be76c8c https://poweruser.blog/lightweight-windows-containers-using-...
- mulmen 6y agoNeat! I had no idea this was a thing, thanks for sharing.
- jcelerier 6y agoI wouldn't call "running an app in a linux VM on windows", "running linux". As a user, your main interface with your computer is windows, which is what "i'm running windows" means, and obviously "you can use the same kernel features as Docker to sandbox applications yourself" wouldn't work, e.g. you couldn't sandbox photoshop like that.