18 ms·
Boxxy puts bad Linux applications in a box with only their files
- deleted 2y ago[deleted]
- emiliakurtz 2y ago[flagged]
- M95D 2y agoGoboLinux users might be very interested.
- qalmakka 2y agoIsn't this basically what `bubblewrap` already does?
- whiteandmale 2y ago[dead]
- bubblesnort 2y agoCombinations of bwrap, chpst, env, setpriv, and setsid can become unreadable gibberish but otherwise work fine. There's lots of similarly useful stuff that can be combined for specific needs.
- johnisgood 2y agoOr firejail?
- ruthmarx 2y agoPeople love to reinvent the wheel *shrug*
- andrewla 2y agoThis seems significantly more lightweight than bubblewrap -- it doesn't attempt to do much in the way of containerization or isolation, just remapping certain files. I feel like this could be done in a small shell script if you reduce the configurability.
- INTPenis 2y agoIs this like a better version of toolbx? Because I love toolbx and use it daily, but I wish it allowed for more granular configuration. For example I'd want to create more containers for more specific use cases where they only have access to specific dirs in my HOME.
- abhinavk 2y agoTry distrobox. The default behavior is like toolbx but you can change home folder to ~/distrobox/appx or go all-out and unshare everything. https://github.com/89luca89/distrobox https://github.com/89luca89/distrobox
- INTPenis 2y agoYou mean combining the --unshare-all and the --volume arguments to create my own list of HOME dirs to share? The docs are really sparse, lots of examples that use --unshare-all but nowhere do they explain it.
- abhinavk 2y agoYou can set DBX_CONTAINER_HOME_PREFIX=~/allmyboxes in ~/.config/distrobox/distrobox.conf to do that. It will share ~/allmyboxes/my-debian-distrobox1 as the home dir. If you pass --dry-run, it will spit out the underlying podman/docker command. That was frankly better than trying to find documentation.
- INTPenis 2y agoYeah I figured out eventually that I can use --home and --volume to set an alternative home and then mount individual dirs from my home into the container's home. Thanks, I'm using distrobox now.
- HeatrayEnjoyer 2y agoI don't do drugs, mmm-nnn.
- OmarAssadi 2y agoI was right about to go to another site and had to do a double-take when my eyes caught the title; I hadn't thought about her in YEARS. I hope it's boxxy on purpose.
- dangsux 2y ago[dead]
- Semaphor 2y agoIt is not https://news.ycombinator.com/item?id=34730942 https://news.ycombinator.com/item?id=34730942 > No! I just thought it was a cute name ("put things in a box"), and it wasn't a common repo name on GitHub.
- BoringTimesGang 2y ago>I hope it's boxxy on purpose. The default branch is `mistress`, I suspect the author has a sense of humour.
- skipants 2y agoLOL That's amazing! I'm stealing that for my next open source project.
- dsmurrell 2y agoBeetles.
- dloss 2y agoRelated question: Which software do you recommend to sandbox a locally running AI agent, so that it can only access parts of the filesystem (e.g. one folder) and an allow-list of URLs?
- okasaki 2y agoWhy not docker?
- ravetcofx 2y agoChroot or AppArmor+Firejail
- BonusPlay 2y agoDepends how much patience you have. Firejail if you want ease of use (there are a lot of ready profiles to be used). Bubblewrap if you want more security, at the cost of having to do more manual work. TL;DR Firejail is a blacklist of things, while bubblewrap is an whitelist, so bwrap policies tend to be tighter.
- OJFord 2y agoThat depends on the profile, firejail supports both.
- amelius 2y agoWhat are people using to quickly test new ML models from github in a sandbox? Do you fire up a docker image? Do you use virtualbox? ...
- stavros 2y agoWhat's allowing the AI agent to access files at all in the first place?
- dmd 2y agoPeople ascribe magical powers to them.
- Semaphor 2y agoLots of comments in the thread from February 2023: https://news.ycombinator.com/item?id=34730520 https://news.ycombinator.com/item?id=34730520
- _cenw 2y ago> boxxy is a part of the amyware discord server. Can we reverse this trend? I've recently started to see an FAQ, on GitHub, hide the answer with a deeplink into Discord channels where you needed to find the guild to join first. I've never gotten disinterested in a project that fast. This needs to stop.
- Kiro 2y agoI disagree. The only time I'm actively engaging with a project is if it has a Discord server. I don't want to post questions in a public forum.
- freedomben 2y ago> I don't want to post questions in a public forum. Why?
- ThatMedicIsASpy 2y agoBecause they are a discord user. And don't have a forum account. In todays world forums can also be a pain as looking at picture attachments most of the time require accounts.
- stavros 2y agoEspecially Discord "forums", the black hole of the internet. Neither real-time so I can get my question answered when I'm there, nor open enough to find old questions through Google, nor popular enough that people browse through them to answer. People go "oh, Discord has forums, we don't need a web forum", and the world is now a little bit worse.
- Y_Y 2y agoMaybe there's value in (semi-)automated discord exfiltration. Like A browser plugin that grabs all the data from any discord pages I look at and mirrors it somewhere on the open web.
- dudus 2y ago[flagged]
- itsgabriel 2y agoYou might have switched up your threads, SO's decline is over here https://news.ycombinator.com/item?id=41376770 https://news.ycombinator.com/item?id=41376770
- thomond 2y ago[flagged]
- nine_k 2y agoHas "queer" become a slur? Even as a part of the "LGBTQ+" moniker?
- pmx 2y agoIt used to be a slur, then the community adopted the word as their own. That historical negative connotation still lingers for those who remember it that way, though.
- thomond 2y agoThe 'N' word has seen a similar adoption and "historical negative connotatione still lingers for those who remember it that way" as well. I doubt they'll allow that particular slur however(and rightly so).
- pessimizer 2y agoThe big difference is that black people didn't "reclaim" the "N"-word slur, we always used it, it just doesn't mean the same thing when we say it to each other*. Now, the internet and the media spend a lot of effort to keep us from saying it. In the case of "queer", it seems that even straight people somehow got to reclaim it, everybody is throwing it around, and that a large number of gay people don't like it at all. ----- [*] Between black people it's usually more about telling somebody they're full of themselves. From white people to black people, empirically, it has almost always been followed with a murder threat.
- nine_k 2y agoI think that the word "queer" has been used for a long enough time in neutral to positive contexts, including official. I won't see it as an offensive word by itself. It's similar to what happened to the word "geek".
- blueflow 2y agoFrom the README: It wants to put its config in ~/.tmux.conf. With boxxy, you can put its config in ~/.config/tmux/tmux.conf From tmux(1): By default, tmux loads the system configuration file from /etc/tmux.conf, if present, then looks for a user configuration file at ~/.tmux.conf $XDG_CONFIG_HOME/tmux/tmux.conf or ~/.tmux.conf. XDG_CONFIG_USER defaults to "$HOME/.config". Very poor choice for an example.
- denotational 2y agoThis is a (relatively) recent addition to tmux, I remember this being an annoyance a while ago, and you can find the discussion on GitHub if you search.
- blueflow 2y agoHeh, but if its in Debian stable then its probably not recent.
- setopt 2y agoIt was added upstream in 2020. Since tmux is often used on servers that don’t upgrade frequently, I still regularly work on some servers without this feature. In related news, Vim just added XDG support upstream as well. Just waiting for Zsh to follow suit now :)
- doubled112 2y agoI've been working around this on Zsh by using ~/.zshenv to source the rest of the config from ~/.config/zsh for years now. I would welcome the change.
- Fnoord 2y agoI've been using symlinks for Vim and Tmux for ages and waited for them to catch up. Seems they've done it, finally.
- scoot 2y ago
- eithed 2y agoLove that the user name in examples is mistress
- ordu 2y agoI believe it is the default branch of git called 'mistress' instead of 'master' or 'main'.
- eithed 2y agoOh... tbh I've never thought about master this way. I just imagined the conversation: > mistress - it puts paths in `.config` > boxxy - yes mistress
- notamy 2y agoYes! GitHub username queer with default branch mistress was too good of a bit to pass up.
- kstrauser 2y agoWell, at least a few of us noticed and think it was hilarious. Nicely done.
- anonfordays 2y ago[flagged]
- demomode 2y agoFYI. There is a XDG checker called "xdg-ninja"[1] > A shell script that checks your $HOME for unwanted files and directories. > When xdg-ninja encounters a file or directory it knows about, it will tell you whether it's possible to move it to the appropriate location, and how to do it. 1. https://github.com/b3nj5m1n/xdg-ninja https://github.com/b3nj5m1n/xdg-ninja
- itsthejb 2y agoIndeed. Although this tool looks like a way to work around those holdouts which refuse to provide an official customisation point
- whiteandmale 2y ago[dead]
- notamy 2y agoOh this is my project! I haven’t had energy to work through pending issues for a while due to health reasons; I do still have interest in maintaining it but my health makes it a struggle.
- jcmfernandes 2y agoI'm sorry to hear that. Thanks for the tool and wishing you a speedy recovery!
- deleted 2y ago[deleted]
- junon 2y agoSorry to hear that. Amazing GitHub username by the way.
- justinmarsan 2y agoI don't know if the reference was on purpose, but I now have this 13 years-old remix on repeat : https://www.youtube.com/watch?v=LHNZVAjadqY https://www.youtube.com/watch?v=LHNZVAjadqY
- dredmorbius 2y agoNo relation: <https://news.ycombinator.com/item?id=34730942 https://news.ycombinator.com/item?id=34730942>
- cdelsolar 2y agoOMG boxxy
- yellowapple 2y agoOn a tangent: it bugs me that the default XDG directory structure doesn't fully match the standard Linux directory structure. What's with these inconsistent defaults? XDG_DATA_HOME="$HOME/.local/share" # okay, reasonable XDG_CONFIG_HOME="$HOME/.config" # ...uh, pardon? XDG_STATE_HOME="$HOME/.local/state" # well at least it's in ~/.local XDG_CACHE_HOME="$HOME/.cache" # ...but this one ain't; what in tarnation? It'd make more sense to be consistent with how system-wide applications use /usr or /usr/local, like so: XDG_DATA_HOME="$HOME/.local/share" XDG_CONFIG_HOME="$HOME/.local/etc" XDG_STATE_HOME="$HOME/.local/var/lib" XDG_CACHE_HOME="$HOME/.local/var/cache" This would make $XDG_(CONFIG|STATE|CACHE)_HOME consistent with $XDG_DATA_HOME, and also consistent with existing conventions around ~/.local/bin and ~/.local/lib. The XDG spec ain't the only naughty naughty boy here, either. Flatpak puts all of its application data in ~/.var/app, whereas it'd make a lot more sense in ~/.local/var/lib/flatpak/app. And of course, the subject of Boxxy (and, as others mentioned, xdg-ninja) is the countless apps contributing further to the chaos. Of course, all this would stop being an issue entirely if Linux would just embrace union mounts like Plan 9 did and overlay everything onto /bin, /lib, /share, /etc, and so on. Hell, if I were the not-so-benevolent dictator for life of the Linux ecosystem I'd take the opportunity to rename all those weird UNIX™ vestiges, too, like /etc→/conf and /var→/data - but if we're gonna hang on to those vestiges, the least XDG could do is encourage consistency with them. Maybe I just need to make my own distro and finally say goodbye to what little remains of my sanity.
- eviks 2y ago> alias aws="boxxy aws" That's rather inconvenient to alias ever app, is there a more ergonomic way to rewrite the file access calls?