News for hackers. Stuff that matters.

A comment on Server-side sandboxing: Containers and seccomp.

Re:Server-side sandboxing: Containers and seccomp by sargun on Tuesday October 24, 2023 @04:51PM (#38005359)
Seccomp BPF is great. There was some recent issues due to IO_uring and extensible syscalls, but I believe for now, those issues are avoidable.

I believe the next generation looks something like landlock (https://docs.kernel.org/userspace-api/landlock.html).

[ Parent | on HN ]
Re:Server-side sandboxing: Containers and seccomp by johnkoepi on Wednesday October 25, 2023 @03:38AM (#38010262)
+1
[ Parent | on HN ]
Re:Server-side sandboxing: Containers and seccomp by johnkoepi on Wednesday October 25, 2023 @03:55AM (#38010363)
I love ideas behind Landlock but I don't fully see the struggle currently without taking into considerations issues with io_uring api. Seccomp nowadays with AppArmor|SElinux is enough even for Nested rootless containers. Nested even into std runc things. Both AppArmor and Seccomp profiles are stackable. If you don't need to generate unique profiles per each container you should be fine...
[ Parent | on HN ]