4 ms·

I've been messing with sandboxing using "bwrap" for random itch.io games I download to play and it isn't trivial to get it working with least privileges. I have

I've been messing with sandboxing using "bwrap" for random itch.io games I download to play and it isn't trivial to get it working with least privileges. I have so far been unable to get "Microlandia" to run, but other Unity games are running just fine under "bwrap". I am excited to see more Landlock tools emerge that make this task easier. - https://github.com/containers/bubblewrap https://github.com/containers/bubblewrap - https://codeberg.org/dannyfritz/dotfiles/src/commit/383430085660a7af936c93344d6499c24e028cae/bin/run-game https://codeberg.org/dannyfritz/dotfiles/src/commit/38343008... - https://explodi.itch.io/microlandia https://explodi.itch.io/microlandia

webstrand 10mo ago
I was just playing with bwrap for isolating npm project actions from the rest of my system. bwrap --unshare-pid --dev-bind / / --tmpfs /home --bind "$(pwd)" "$(pwd)" bash it seems to work fairly well? But I just started playing with bwrap this weekend. I do wish bwrap could be told "put the program in this pre-prepared network namespace" because accessing unsecured local dev servers could also be an issue.
- tommica 10mo ago
  I had this idea of having toolbox+custom user for each project - that way it would be "simple" to have isolated environments, but it does lead to a lot of bloat. And I do think it is a naive solution. Bwrap seems like a better option.
  - jeroenhd 10mo ago
    I think a combination of custom users + a whole bunch of sandboxing is exactly what you'd get out of systemd-nspawn if you're willing to write the config: https://wiki.archlinux.org/title/Systemd-nspawn https://wiki.archlinux.org/title/Systemd-nspawn bwrap seems a lot easier but if you want more control (or, for instance, want to run a Ubuntu basis because that's what a lot of games are compiled against), systemd-nspawn can be quite powerful.
  - bflesch 10mo ago
    thats how android does it. every app is different user.
    - tommica 10mo ago
      Oh really? That's a surprise

webstrand 10mo ago

I was just playing with bwrap for isolating npm project actions from the rest of my system. bwrap --unshare-pid --dev-bind / / --tmpfs /home --bind "$(pwd)" "$(pwd)" bash it seems to work fairly well? But I just started playing with bwrap this weekend. I do wish bwrap could be told "put the program in this pre-prepared network namespace" because accessing unsecured local dev servers could also be an issue.

tommica 10mo ago
I had this idea of having toolbox+custom user for each project - that way it would be "simple" to have isolated environments, but it does lead to a lot of bloat. And I do think it is a naive solution. Bwrap seems like a better option.
- jeroenhd 10mo ago
  I think a combination of custom users + a whole bunch of sandboxing is exactly what you'd get out of systemd-nspawn if you're willing to write the config: https://wiki.archlinux.org/title/Systemd-nspawn https://wiki.archlinux.org/title/Systemd-nspawn bwrap seems a lot easier but if you want more control (or, for instance, want to run a Ubuntu basis because that's what a lot of games are compiled against), systemd-nspawn can be quite powerful.
- bflesch 10mo ago
  thats how android does it. every app is different user.
  - tommica 10mo ago
    Oh really? That's a surprise