3 ms·
So what's the difference between nsjail[1] and bubblewrap[2]? [1] https://github.com/google/nsjail https://github.com/google/nsjail [2] https://github.com/cont
by bdahz 3y ago
So what's the difference between nsjail[1] and bubblewrap[2]?
[1] https://github.com/google/nsjail https://github.com/google/nsjail
[2] https://github.com/containers/bubblewrap https://github.com/containers/bubblewrap
- xyzzy_plugh 3y agobubblewrap aims to be reasonably secure by default but leaves sleeping soundly at night as an exercise to the reader. It's not exhaustive. It's more of a blast radius/convenience tool. Conversely nsjail aspires to facilitate sleeping soundly out of the box, with security as the primary motivating factor.
- ximm 3y agoI don't have extensive experience with nsjail, but from reading the docs it seems to me like nsjail covers namespaces, cgroups and virtual networking, while bwrap only covers namespaces. On the other hand, bwrap is deliberately kept simple because it is SUID.