4 ms·
I don’t think any platform, either Linux or Windows, has successfully implemented secure sandboxing aside from true virtualization, if that. The isolation provi
by iancarroll 5y ago
I don’t think any platform, either Linux or Windows, has successfully implemented secure sandboxing aside from true virtualization, if that. The isolation provided by kernel-level sandboxing like cgroups has proven to be a thin layer of protection in practice; it will just shift the problem to fixing sandboxing issues.
- kritr 5y agoI think https://gvisor.dev/ https://gvisor.dev/ might be the closest thing I can think of to container level sandboxing that tries to add meaningful security guarantees.