We are making Sandboxie a free tool, with plans to transition it to open source

Re:We are making Sandboxie a free tool, with plans to transi... by e12e on Sunday November 10, 2019 @07:09AM (#21497677)

Firejail is probably what you want. I'd be wary of considering Docker as a jail - it does some isolation, but I've yet to see any serious effort or analysis of "safely run arbitrary code as root in docker and avoid escape" (the scenario being at least a full compromise of the app, with potentially an elevation to root in the container). Docker is "(shipping) container first" not "(CIA black site) container first".

Firejail isn't perfect - but it's at least designed to be a jail/sandbox.

There's also the possibility to use lxc via lxd - if you're running xorg you can forward x11 over ssh to the container (or vm). However access to xorg is problematic (eg shared clipboard, window/screen access).

Wayland supposedly does "everything x does" - but I don't know how you connect displays via the network.

But in the end (even though you requested "not vm") - I'd probably have a look at qubes os: https://www.qubes-os.org/

Afaik it mitigates the "shared xorg server" via using x-in-x nested servers (eg xephyr).

Also came across this, which appears to be a little better than "just" docker - but I'd probably still go with firejail or qubes os:

https://github.com/mviereck/x11docker/blob/master/README.md

[ Parent | on HN ]

Re:We are making Sandboxie a free tool, with plans to transi... by technofiend on Monday November 11, 2019 @12:08AM (#21502302)

CentOS / RHEL has UID and GID mapping backported from the 4.x Linux kernel which podman supports. You can run as root in the container and still be remapped to a non-root user outside of it. If you want a locked desktop combine that with Guacamole docker images.

[ Parent | on HN ]