Tough to keep reading after seeing this kind of misunderstanding > There are a whole bible of strategies that ChromeOS implements to keep Chrome in it’s own

Tough to keep reading after seeing this kind of misunderstanding > There are a whole bible of strategies that ChromeOS implements to keep Chrome in it’s own little world. Among the strategies involve cgroups, namespacing, seccomp, etc… This technologies basically do what Docker does, but without the overhead of a virtualized Linux kernel Docker doesn’t have a virtualized Linux kernel, it uses the same technologies mentioned directly on the existing kernel. > Also, Linux desktop software has a very all-or-nothing approach to permissions. Root, or user. I wonder why more systems don’t make use of Linux capabilities [1]. Technically root hasn’t been necessary for years; it’s just a convenient shorthand for “all capabilities”. Lots of things that needlessly run as root could instead be granted a much more limited set of capability xattrs instead by the package manager and consented to by the user. Using root in 2023 is lazy. [1] https://man7.org/linux/man-pages/man7/capabilities.7.html https://man7.org/linux/man-pages/man7/capabilities.7.html