4 ms·

The modern Linux kernel allows you to sandbox applications natively. There are tools that make this easy to set up, for instance [1]. [0]: https://blog.cloudfl

by vngzs 5y ago

The modern Linux kernel allows you to sandbox applications natively. There are tools that make this easy to set up, for instance [1]. [0]: https://blog.cloudflare.com/sandboxing-in-linux-with-zero-lines-of-code/ https://blog.cloudflare.com/sandboxing-in-linux-with-zero-li... [1]: https://firejail.wordpress.com/ https://firejail.wordpress.com/

junon 5y ago
Those sandboxes are certainly not free to set up (internal kernel locking) fwiw.
rjzzleep 5y ago
I use firejail and have the standard redirects in /usr/local/bin for most firejail supported applications, but the performance hit is definitely noticeable. I'm on an i7-8650U on my laptop with 16G ram. Sandboxing _can_ be without overhead, but in the case of firejail it's definitely not the case.
- rfoo 5y ago
  > performance hit is definitely noticeable Could you please name which application, and how do you notice it?
  - rjzzleep 5y ago
    I notice it by how long it takes to start applications when I run them through firejail vs. when I run them directly. I don't know if it also makes a difference during execution. EDIT: it's kinda amusing to get downvoted on this. a) There's no performance issue. Just use linux sandboxes b) There are these possible performance hits c) I use those sandboxes and I have observe X performance issues. a) Your performance issues are not valid performance issues, because I say so. Ok, gotcha
    - swiley 5y ago
      That's really a caching issue. Normally dynamically linked bins share a lot of code pages (many are already loaded) due to SOs. In jailed apps these are duplicated and have to be loaded again for each app.
      - sokoloff 5y ago
        It’s a caching issue that manifests itself as a performance difference, which is all GP claimed.
  - hjek 5y ago
    I'm using a low-spec laptop, so I usually notice these things before others. With Firejail I don't notice any performance hit at all on any of the apps I've used: Telegram, various windows games under Wine, Chromium.

by vngzs 5y ago

junon 5y ago

Those sandboxes are certainly not free to set up (internal kernel locking) fwiw.

rjzzleep 5y ago

I use firejail and have the standard redirects in /usr/local/bin for most firejail supported applications, but the performance hit is definitely noticeable. I'm on an i7-8650U on my laptop with 16G ram. Sandboxing _can_ be without overhead, but in the case of firejail it's definitely not the case.

rfoo 5y ago
> performance hit is definitely noticeable Could you please name which application, and how do you notice it?
- rjzzleep 5y ago
  I notice it by how long it takes to start applications when I run them through firejail vs. when I run them directly. I don't know if it also makes a difference during execution. EDIT: it's kinda amusing to get downvoted on this. a) There's no performance issue. Just use linux sandboxes b) There are these possible performance hits c) I use those sandboxes and I have observe X performance issues. a) Your performance issues are not valid performance issues, because I say so. Ok, gotcha
  - swiley 5y ago
    That's really a caching issue. Normally dynamically linked bins share a lot of code pages (many are already loaded) due to SOs. In jailed apps these are duplicated and have to be loaded again for each app.
    - sokoloff 5y ago
      It’s a caching issue that manifests itself as a performance difference, which is all GP claimed.
- hjek 5y ago
  I'm using a low-spec laptop, so I usually notice these things before others. With Firejail I don't notice any performance hit at all on any of the apps I've used: Telegram, various windows games under Wine, Chromium.