Post #2192993

@june@ublog.kimapr.net @navi@social.vlhl.dev Well this is coming from a security researcher who knows a lot about Linux security issues so I think they know what they're doing unless someone proves me wrong or smth Bubblewrap is pretty much able to do around 90% of the stuff systemd already does in terms of sandboxing without having to get its features reimplemented in the init system itself There are use cases for sandboxing a whole bootstrap process (https://github.com/fosslinux/live-bootstrap) or just building a few packages in an isolated environment (as done by a few package build systems), so I'm pretty sure that is sufficient on its own along with seccomp Bubblewrap has a large amount of CLI options if you have specific requirements in mind, it's very polyvalent Even ChromeOS has a tool for similar purposes (https://google.github.io/minijail/)