3 ms·
how do they make sure the user doesn't things like "rm -rf *" or something?
by akudha 3y ago
how do they make sure the user doesn't things like "rm -rf *" or something?
- necovek 3y agoThey don't care: you can use one of the systems with immutable root filesystems (eg. Ubuntu Core, Fedora CoreOS...), and you need to start a system from scratch for every "compilation" (you can optimize and keep the same image for one user: if they mess up the system, so be it). Back in the day, one used chroot to achieve this, then we started doing VMs, and now it's possible to use "system containers" (eg. with lxd on Ubuntu: regular docker containers leak too much of the parent system into the container). Still, VMs are generally safer because it's harder to break out of the sandbox (eg. a system can be virtualized using different technologies, so finding an exploit in one will not make it vulnerable with another). Eg. AWS Lambdas are implemented as quick-booting VMs using an optimized Linux image and optimized VM runtime (firecracker): not saying you need to go that far, but it should tell you what's possible.