3 ms·

Not exactly what you're looking for, but unveil[0, 1] can help fulfill a similar goal. It looks like Docker has some progress as well, via an alpine VM[2]. I

• spijdar 5y ago
  Unveil and pledge are great at restricting and effectively sandboxing processes a la a simpler version of Linux's SECCOMP. If you're using namespaces for process isolation or sandboxing, it can do the trick. They're not a general replacement for Linux's namespaces, though. The only alternative on OpenBSD would be running the alternative environment in a VM, or running Linux in a VM and then using namespaces there. FreeBSD comes closer with jails, but still doesn't match the ease of which you can use rootless namespaces to e.g. dump a tar file of a rootfs into a directory and "chroot" into it, all without root. (the OpenBSD world will never implement this sort of thing by design, and it has merits, as user namespaces has created several privilege escalation vulnerabilities over the years, which is one reason some distros like RHEL/CentOS disable it on their kernels)