3 ms·

> I think you may find that "just get shit done" is even more true for BSD today than it is for Linux Can I run sandboxed rootless containers on OpenBSD?

• Shared404 5y ago
  Not exactly what you're looking for, but unveil[0, 1] can help fulfill a similar goal. It looks like Docker has some progress as well, via an alpine VM[2]. I may have misunderstood your question though, I haven't done much with containers. [0] https://man.openbsd.org/unveil https://man.openbsd.org/unveil [1] https://lwn.net/Articles/767137/ https://lwn.net/Articles/767137/ [2] https://medium.com/@dave_voutila/docker-on-openbsd-6-1-current-c620513b8110 https://medium.com/@dave_voutila/docker-on-openbsd-6-1-curre...
  • spijdar 5y ago
    Unveil and pledge are great at restricting and effectively sandboxing processes a la a simpler version of Linux's SECCOMP. If you're using namespaces for process isolation or sandboxing, it can do the trick. They're not a general replacement for Linux's namespaces, though. The only alternative on OpenBSD would be running the alternative environment in a VM, or running Linux in a VM and then using namespaces there. FreeBSD comes closer with jails, but still doesn't match the ease of which you can use rootless namespaces to e.g. dump a tar file of a rootfs into a directory and "chroot" into it, all without root. (the OpenBSD world will never implement this sort of thing by design, and it has merits, as user namespaces has created several privilege escalation vulnerabilities over the years, which is one reason some distros like RHEL/CentOS disable it on their kernels)