Post #2071689
2026-05-06 04:33 UTC
@navi @june what do you think about the approach described in the last paragraph of this? https://madaidans-insecurities.github.io/guides/linux-hardening.html#systemd-service-sandboxing
i don't necessarily think it's needed to reimplement that on your own but that's how i see things on my own so i dunno tbh
Replies (2)
-
@june@ublog.kimapr.net 2026-05-06 04:36
@stilic @navi this doesnt really explain or help anything other than making a blind assumption that bubblewrap can do everything there, and there still isnt an example.
-
@navi@social.vlhl.dev 2026-05-06 09:55
@stilic@social.oss.zone @june@ublog.kimapr.net bubblewrap is unfit for openrc or any other init system it always forks, even when not using pid namespaces, and doesn't handle signals properly openrc will likely have it's own thin helper around the unshare syscall, or, it'll call the unshare tool from util-linux or busybox