3 ms·
Is there a technology in existence that would facilitate this from userspace and wouldn't require elevated kernel privileges to set caps?
by VWWHFSfQ 2y ago
Is there a technology in existence that would facilitate this from userspace and wouldn't require elevated kernel privileges to set caps?
- semi-extrinsic 2y agoFrom my cursory googling, I believe seccomp on Linux is one way to achieve this. See e.g. Cloudflare's "sandbox" wrapper: https://github.com/cloudflare/sandbox https://github.com/cloudflare/sandbox FWICT, it's not possible to achieve something like this reliably on Windows natively, but maybe in WSL it could work. On Mac, there is the similar libsecinit aka App Sandbox which also can be spawned from a userspace process, I think? Of course in every case the program spawning the sandbox has to be outside the sandbox. But having to trust Rye or UV is much better than having to trust thousands of "RandomDevsNichePythonPackage".