News for hackers. Stuff that matters.

A comment on Bubblewrap: Unprivileged sandboxing tool for Linux. Parent comment

Re:Bubblewrap: Unprivileged sandboxing tool for Linux by fock on Monday March 28, 2022 @03:43AM (#30828149)
First problem is that proper (incl. X11...) isolation costs you 3D (so not great for Firefox). Otherwise there is "toolbox" by Fedora, which you could surely combine with Xephyr for a wine-like, more isolated experience. I do that with a shell-only workflow (though on my HiDPI-machines I still have to patch Xephyr to scale the output (which is pretty easy using its GL-backend tbh, but I need to refine my amateur C dabblings to release that).

EDIT: I'm happy to discuss how to use Wayland with proper isolation and 3D! (and some frame-decoration)

[ Parent | on HN ]
Re:Bubblewrap: Unprivileged sandboxing tool for Linux by rosetremiere on Monday March 28, 2022 @04:14AM (#30828340)
I didn't know about "toolbox": it seems close to what I want. About 3D, does calling a program through `bwrap` disable opengl or something?
[ Parent | on HN ]
Re:Bubblewrap: Unprivileged sandboxing tool for Linux by fock on Monday March 28, 2022 @06:42AM (#30829107)
well, depending on what you do, you usually need access to the dri-device, the X11-driver and X11 (socket). This is relatively insecure I suppose because it exposes a giant attack-surface. Everything trying to mitigate this (short of running VNC) unfortunately still has some, but I would expect noone targets these broad-spectrum. An interesting thing to do would be to run with VGL and a quadro/...-GPU which allows partitioning into different rendering devices.

Haven't tried reading about this with wayland.

[ Parent | on HN ]
Re:Bubblewrap: Unprivileged sandboxing tool for Linux by PausGreat on Monday March 28, 2022 @06:39AM (#30829102)
> Xephyr

It's easier to use Wayland. Additionally, Toolbox does not sandbox the application.

[ Parent | on HN ]
Re:Bubblewrap: Unprivileged sandboxing tool for Linux by fock on Monday March 28, 2022 @08:01AM (#30829558)
Then how will wayland tell me, which container a window comes from? (besides that, most software I use in containers is very much preeee-wayland). Thanks for the correction on toolbox, I know remember again, why I have my own bwrap-wrapper.
[ Parent | on HN ]