3 ms·
Docker is not a sandbox. There is some work that can be done to harden it, but you're better off looking at genuinely sandboxing your dev environment
by mfro 11mo ago
Docker is not a sandbox. There is some work that can be done to harden it, but you're better off looking at genuinely sandboxing your dev environment
- ashishb 11mo agoWhat is genuine sandboxing? Everyone waives there hands by saying this
- mfro 11mo agoGood question with a lot of possible answers. You can take sandboxing as far as you want, really. I typically just use bubblewrap (linux)
- ashishb 11mo agoI have a perfect set up in inside docker that works. I would love to know why bubblewrap is a superior alternative. Here's mine https://github.com/ashishb/dotfiles/blob/067de6f90c72f0cf849fb6edcd941b347712ced9/bashrc_includes/custom_aliases.bash#L19-L21 https://github.com/ashishb/dotfiles/blob/067de6f90c72f0cf849...
- mfro 11mo agoMy understanding is that docker escapes are not all that difficult, and your aliases really aren’t doing much to harden the container. but I am not an expert on the matter. I’m sure there is plenty of info online
- ashishb 11mo ago> My understanding is that docker escapes are not all that difficult, 1. Show me how you would escape Docker 2. Show me npm packages doing this in the wild