3 ms·

Each kind of namespace provides its own kind of boundary. Yes, you need something like bubblewrap to stitch that all together. And it is kinda leaky, especially

• ux266478 1y ago
  > I don't see how a user namespace does not prevent/limit privilege escalation. They only prevent a single class of privilege escalation from setuid usage within the namespace. You can still obtain root using race conditions, heap overflows, side-channels, etc. or by coordinating with something outside of the namespace like a typical chroot escape. Here's an old (patched) example of escaping the sandbox: https://lwn.net/Articles/543273/ https://lwn.net/Articles/543273/ > More than that, I'm interested if there is some broader consensus I'm missing on the shortcomings of namespaces. The consensus is that they're not security features on Linux. I'm not sure who sold you on the idea that they were, because that was not handed down by the kernel devs. https://lwn.net/Articles/657744/ https://lwn.net/Articles/657744/