Sandstorm.io's containerization (which uses Linux namespaces just like Docker and others) is not affected by this, because add_key, request_key, and keyctl are

Sandstorm.io's containerization (which uses Linux namespaces just like Docker and others) is not affected by this, because add_key, request_key, and keyctl are among the syscalls which Sandstorm disables with seccomp. The other issues the author alludes to from his previous post on opensource.com also do not affect Sandstorm, because it does not mount /proc or /sys and only exposes the devices null, zero, and urandom. https://blog.sandstorm.io/news/2014-08-13-sandbox-security.html https://blog.sandstorm.io/news/2014-08-13-sandbox-security.h...