4 ms·
Yes but NixOS does all of these things already, without the process overhead
by amusingimpala75 5mo ago
Yes but NixOS does all of these things already, without the process overhead
- umvi 5mo agoEven the minimal SBOM part? It's hard to be more minimal than a busybox binary.
- amusingimpala75 5mo agoThat’s fair, NixOS avoids the direct stuff from Docker itself but if you’re basing on an Alpine image or something that would probably be more minimal / smaller
- staticassertion 5mo agoNix wraps your process in namespaces and seccomp?
- amusingimpala75 5mo agoNot by default but tools like agent-sandbox.nix (bwrap, seccomp) or other nixpak (just bwrap but more popular) can provide those capabilities if you want in a fairly simple interface