4 ms·
It does, but it is far from seamless / widely used. It is a little bit more than firejail packed for NixOS.
by nextos 3y ago
It does, but it is far from seamless / widely used. It is a little bit more than firejail packed for NixOS.
- yjftsjthsd-h 3y agoNixOS is a very DIY/build-whatever-you-want system; what more would you want than it being available including the wrapper function to make applications default to running under it? I guess it could be included in the default ISOs if you wanted to showcase it, but given the non-zero friction it adds I'm not sure about the cost/benefit on that.
- nextos 3y agoI know, I maintain quite a few items in NixPkgs. My point is that Linux distributions are not taking sandboxing seriously compared to mobile or macOS, and this is a big security issue. E.g., if one runs a compromised binary, such as PyTorch [1], sandboxing as implemented by Firejail or bwrap provides defense in depth. You might be running a compromised binary, but it won't be able to read your entire $HOME and steal your data. I think NixOS is in a great position to offer seamless integration of one sandboxing framework, thanks to the declarative nature of package derivations. But it'd probably need to support just one framework, as it's a pretty foundational component, just like you can't easily switch from systemd to something else. [1] https://pytorch.org/blog/compromised-nightly-dependency/ https://pytorch.org/blog/compromised-nightly-dependency/