4 ms·
I use nix + bwrap, which gives a similar result. it works well enough, though I really ought to restrict reads to only the closure.
by sterlind 5mo ago
I use nix + bwrap, which gives a similar result. it works well enough, though I really ought to restrict reads to only the closure.
- yjftsjthsd-h 5mo ago> I use nix + bwrap In an automated way, or have implemented as hand-written wrappers? And regardless, have you published the code (and/or talked about how it works) anywhere? It'd be really nice to have a gentler onramp to sandboxing things, and nix should be well-placed for it.
- sterlind 5mo agoan automated way, as part of a tree-based harness. I haven't published the code yet but should hopefully be able to soon!
- yjftsjthsd-h 5mo agoCould you point me at a blog or github or something I can follow to see it if you do publish?