6 ms·
Docker and other container runners allow it. https://containers.dev/ https://containers.dev/ allows it too. https://github.com/microsoft/litebox https://github
by OutOfHere 9mo ago
Docker and other container runners allow it. https://containers.dev/ https://containers.dev/ allows it too.
https://github.com/microsoft/litebox https://github.com/microsoft/litebox might somehow allow it too if a tool can be built on top of it, but there is no documentation.
- simonw 9mo agoEvery time I use Docker as a sandbox people warn me to watch out for "container escapes". I trust Firecracker more because it was built by AWS specifically to sandbox Lambdas, but it doesn't work on macOS and is pretty fiddly to run on Linux.
- OutOfHere 9mo agoI think ChatGPT can do a much better job than I can for guiding how to safely use Docker as a sandbox: /share/69875282-1e38-8012-b627-7c0a678f9365 It's not industrial-grade safety for public use, but it'll do for personal use. Other tools for it are also mentioned.
- its-summertime 9mo agoOutside of VM usage, the answer seems to be (on top of containerization and selinux) writing a tight seccomp filter. Gleaned from https://github.com/containers/bubblewrap/blob/0c408e156b12ddc9097b06ce0a7bdab7085a9af2/README.md#system-security https://github.com/containers/bubblewrap/blob/0c408e156b12dd... and https://github.com/containers/bubblewrap/tree/0c408e156b12ddc9097b06ce0a7bdab7085a9af2/demos https://github.com/containers/bubblewrap/tree/0c408e156b12dd...