Re:Rye: A Hassle-Free Python Experience
by VWWHFSfQ on Tuesday July 09, 2024 @09:09AM
(#40915695)
Is there a technology in existence that would facilitate this from userspace and wouldn't require elevated kernel privileges to set caps?
[ Parent
| on HN ]
Re:Rye: A Hassle-Free Python Experience
by semi-extrinsic on Tuesday July 09, 2024 @09:56AM
(#40916209)
From my cursory googling, I believe seccomp on Linux is one way to achieve this. See e.g. Cloudflare's "sandbox" wrapper:
https://github.com/cloudflare/sandbox
FWICT, it's not possible to achieve something like this reliably on Windows natively, but maybe in WSL it could work. On Mac, there is the similar libsecinit aka App Sandbox which also can be spawned from a userspace process, I think?
Of course in every case the program spawning the sandbox has to be outside the sandbox. But having to trust Rye or UV is much better than having to trust thousands of "RandomDevsNichePythonPackage".