4 ms·

Does this use namespaces or chroot? The readme mentions namespaces (like Flatpak?), but https://github.com/queer/boxxy/blob/mistress/src/enclosure/mod.rs https:

Does this use namespaces or chroot? The readme mentions namespaces (like Flatpak?), but https://github.com/queer/boxxy/blob/mistress/src/enclosure/mod.rs https://github.com/queer/boxxy/blob/mistress/src/enclosure/m... seems to indicate it uses chroot.

notamy 4y ago
It creates a new mount namespace, and bind-mounts your ENTIRE filesystem into it, before chrooting, so that it can optionally remount / as ro to prevent applications from writing outside of the desired directories. The namespace is to allow doing the bind mounts in the first place.
- stabbles 4y ago
  Is there an infinite recursion in /tmp? Do you use a bubblewrap-like pivot_root trick?
  - notamy 4y ago
    > Is there an infinite recursion in /tmp? No! The directory in /tmp outside of the "box" is completely empty; the remount of / is only seen within the mount namespace.