3 ms·
To everyone sharing their favorite container-based sandboxing solution: Docker Sandbox does not use containers for isolation. It spawns the workload in a libkru
by codethief 2mo ago
To everyone sharing their favorite container-based sandboxing solution: Docker Sandbox does not use containers for isolation. It spawns the workload in a libkrun-based micro VM, which has vastly different security properties.
- akdev1l 2mo agoDo you mean like Podman has supported for years…? eg: https://josecastillolema.github.io/podman-wasm-libkrun/#libkrun https://josecastillolema.github.io/podman-wasm-libkrun/#libk...
- codethief 2mo agoDo you mean like Docker has supported for years…? (Just configure krun as Docker's OCI runtime.) Obviously, there's a reason why Docker released Docker Sandbox as a separate product: - Barely anyone bothers to configure Docker/Podman with a different OCI runtime like krun. Heck, most people don't even know about OCI runtimes in the first place. Case in point: Most people here in this HN discussion are proposing using "standard" containers (with the default OCI runtime) for sandboxing. This is what I was trying to get at. - A sandbox for agent needs tighter network control. As for differences between the krun OCI runtime and Docker Sandbox (which also uses libkrun), let's please continue the discussion here: https://news.ycombinator.com/item?id=49240662 https://news.ycombinator.com/item?id=49240662 .