3 ms·

I realize that Linux wasn't made for containerization originally and that's why it's so so painful to nest containers, run them without root etc. But I wish we'

I realize that Linux wasn't made for containerization originally and that's why it's so so painful to nest containers, run them without root etc. But I wish we'd already live in a world where all binaries (maybe with the exception of command line tools) ran containerized by default and I, as the user, had to grant explicit access to files, network, hardware/devices, etc. Not just for security reasons (though it'd be nice if `npm install` and `pip install` couldn't mess up my entire system) but also to make external dependencies more explicit.

arcanemachiner 4y ago
`pipx` seems to be a good solution for containing Python dependency clutter.
dilyevsky 4y ago
It's not so painful and most pain comes from Linux insistence on /proc-based APIs as opposed to something similar to Solaris-descendants where it's a json spec (I think xml originally)
PhilippGille 4y ago
Isn't that what Snap and Flatpak are doing? 1) Include dependencies (there can be shared runtimes but they don't mess up the host), 2) sandboxed by default and you need to grant permissions. E.g. Snap sandboxing: https://snapcraft.io/docs/security-sandboxing https://snapcraft.io/docs/security-sandboxing
- ElectricalUnion 4y ago
  It mostly works except for the part 2 failing miserably; so many apps require full filesystem access to have sane behaviour it's not even funny. It doesn't help a lot that instead of having a explicit "can I have a host file" API, the apps are supposed to use a framework that invokes "portals".
kytazo 4y ago
Sounds like android or what a modern linux distro should look like. Sadly both most used userspace distros and the kernel they come with are borderline dangerous and shouldn't be any trusted by people using them, even if they're technical enough to feel comfortable within their environment.
musicale 4y ago
It's a shame that multi-ring security never really made a comeback. The ability to let any ring (such as a user ring) handle the library and system calls of an outer ring (such as a container ring) seems like it would be convenient. Alternately, some microkernels have a more peer-to-peer setup which could work as well.
ashishbijlani 3y ago
I built Packj [1] sandboxing for securing “pip/NPM install”. It uses strace for sandboxing and blocks access to sensitive files and limits traffic to known-good IP addresses. 1. https://github.com/ossillate-inc/packj https://github.com/ossillate-inc/packj

arcanemachiner 4y ago

`pipx` seems to be a good solution for containing Python dependency clutter.

dilyevsky 4y ago

It's not so painful and most pain comes from Linux insistence on /proc-based APIs as opposed to something similar to Solaris-descendants where it's a json spec (I think xml originally)

PhilippGille 4y ago

Isn't that what Snap and Flatpak are doing? 1) Include dependencies (there can be shared runtimes but they don't mess up the host), 2) sandboxed by default and you need to grant permissions. E.g. Snap sandboxing: https://snapcraft.io/docs/security-sandboxing https://snapcraft.io/docs/security-sandboxing

ElectricalUnion 4y ago
It mostly works except for the part 2 failing miserably; so many apps require full filesystem access to have sane behaviour it's not even funny. It doesn't help a lot that instead of having a explicit "can I have a host file" API, the apps are supposed to use a framework that invokes "portals".

kytazo 4y ago

Sounds like android or what a modern linux distro should look like. Sadly both most used userspace distros and the kernel they come with are borderline dangerous and shouldn't be any trusted by people using them, even if they're technical enough to feel comfortable within their environment.

musicale 4y ago

It's a shame that multi-ring security never really made a comeback. The ability to let any ring (such as a user ring) handle the library and system calls of an outer ring (such as a container ring) seems like it would be convenient. Alternately, some microkernels have a more peer-to-peer setup which could work as well.

ashishbijlani 3y ago

I built Packj [1] sandboxing for securing “pip/NPM install”. It uses strace for sandboxing and blocks access to sensitive files and limits traffic to known-good IP addresses. 1. https://github.com/ossillate-inc/packj https://github.com/ossillate-inc/packj