5 ms·
Secure Containerized Browser
- em3rgent0rdr 5y agoIsn't restricting chromium to only ~/Downloads already possible in a regular Linux OS by running chromium inside a chroot?
- tyingq 5y agoPerhaps, though with a fair amount of hassle giving it access to device files, shared libraries, dynamically loaded plugins, and so on.
- tata71 5y agoYou'd use a portable build.
- yjftsjthsd-h 5y agoThe easy option is firejail, which ships with premade profiles to give things exactly what they need to run, ex. https://github.com/netblue30/firejail/blob/master/etc/profile-a-l/chromium.profile https://github.com/netblue30/firejail/blob/master/etc/profil...
- tyingq 5y agoSort of. For example: https://github.com/netblue30/firejail/issues/1950 https://github.com/netblue30/firejail/issues/1950 There are other, similar issues. It's a fair amount of work sussing it all out.
- DarylZero 5y agoNot really, since ~/Downloads isn't inside a chroot. You accomplish it most easily with AppArmor. Anyway, OP is telling you how to do it with OpenBSD, which is also a "regular" OS.
- deleted 5y ago[deleted]
- totetsu 5y agoWhat is the advantages of this over running a snap contained browser?
- xupybd 5y agoCould I do this with Docker on Windows?
- DenseComet 5y agoThere's no fundamental reason you can't since there are X11 clients for windows, which is what this uses. However, FreeBSD jails and Linux containers have very little overhead on their native OS, whereas Docker on Windows runs a Linux VM, so the experience might not be that great. Only way to know though is to try it!
- shipmaker 5y agoI use Sandboxie plus on Windows, easy to set-up, found no faults yet