2 ms·
"Does homebrew do any isolation when building from source? Chroots, separate process namespaces, etc." No. This is why they install as the user. "For security"
by SwellJoe 12y ago
"Does homebrew do any isolation when building from source? Chroots, separate process namespaces, etc."
No. This is why they install as the user. "For security", you see.
I agree that non-root installs are a useful feature for some scenarios. But, the problem with that for servers is you need to be able to start all of your services as different users. That's really not optional. How you get there doesn't really matter, to me, but dpkg and RPM have long had it solved.
I've looked at Guix and Nix, and find them neat. I'm kind of a package management nerd (and I judge all operating systems by their package management story...Windows and Mac OS X are unacceptable, most modern Linuxes are pretty pretty good, FreeBSD is getting better). I'm not sure I'm willing to make all of the tradeoffs and move onto such a foreign system layout, but it's on my radar.
- Ded7xSEoPKYNsDd 12y ago> But, the problem with that for servers is you need to be able to start all of your services as different users. That's really not optional. Anything with an attack surface also must not be able to replace its own binaries/code. Otherwise a one-time exploit is instantly updated to a permanent infection.