3 ms·

If you weren't aware, containers aren't a security boundary. Things like bubblewrap are.

• rlpb 1y ago
  Semantics make hard assertions about "containers" worthless. It depends on what one means by a container exactly, since Linux has no such concept and our ecosystem doesn't have a strict definition.
  • deleted 1y ago
    [deleted]
• NewJazz 1y ago
  What to you think bubblewrap is, if not a container runtime?
• eyberg 1y ago
  bubblewrap is actually worse - there are known escapes in there that haven't been fixed for years
  • quotemstr 1y ago
    Wait. What? What escapes? Is it that bubblewrap not faithfully implement the policy you give it or that there are surprising gaps in the kernel's namespace isolation?
  • deleted 1y ago
    [deleted]
  • udev4096 1y ago
    It is the most widely used sandbox layer for pretty much everything. What escapes are you talking about? Are we supposed to take your word for it? Come on