2 ms·
This thread was originally about using a container / overlay FS that has read access to the underlying filesystem, and writes happen into a temporary overlay.
by rocqua 6y ago
This thread was originally about using a container / overlay FS that has read access to the underlying filesystem, and writes happen into a temporary overlay.
Network connections and certain system-calls might still be scary. However, VM / container systems that are supposed to defend against hostile hosted machines should also be safe here. The only difference is that here information leaking from the host into the VM is the point, instead of dangerous.
- hnlmorg 6y agoNo, this thread was originally about a version of said tool that I built and the dilemma I had about making it safe. A VM would be too slow to spin up to be practical for a live preview. A container would be too host specific. And neither solutions fully solve the problem because all you’re addressing is file system access and, as mentioned several times already, that’s only scratching the surface of the interactions a command line tool can make. My shell, murex, is designed around making networking access as seamless as writing to a local file. Bash does this too with its /dev/$datagram/$port pseudo file system too. So you can’t just dismiss non-local changes as irrelevant.