News for hackers. Stuff that matters.

A comment on Boxxy puts bad Linux applications in a box with only their files.

Re:Boxxy puts bad Linux applications in a box with only thei... by dloss on Wednesday August 28, 2024 @03:47AM (#41377040)
Related question: Which software do you recommend to sandbox a locally running AI agent, so that it can only access parts of the filesystem (e.g. one folder) and an allow-list of URLs?
[ Parent | on HN ]
Re:Boxxy puts bad Linux applications in a box with only thei... by BonusPlay on Wednesday August 28, 2024 @04:14AM (#41377215)
Depends how much patience you have.

Firejail if you want ease of use (there are a lot of ready profiles to be used).

Bubblewrap if you want more security, at the cost of having to do more manual work.

TL;DR Firejail is a blacklist of things, while bubblewrap is an whitelist, so bwrap policies tend to be tighter.

[ Parent | on HN ]
Re:Boxxy puts bad Linux applications in a box with only thei... by OJFord on Wednesday August 28, 2024 @08:20AM (#41378656)
That depends on the profile, firejail supports both.
[ Parent | on HN ]
Re:Boxxy puts bad Linux applications in a box with only thei... by ravetcofx on Wednesday August 28, 2024 @03:52AM (#41377072)
Chroot or AppArmor+Firejail
[ Parent | on HN ]
Re:Boxxy puts bad Linux applications in a box with only thei... by amelius on Wednesday August 28, 2024 @05:14AM (#41377575)
What are people using to quickly test new ML models from github in a sandbox?

Do you fire up a docker image? Do you use virtualbox? ...

[ Parent | on HN ]
Re:Boxxy puts bad Linux applications in a box with only thei... by stavros on Wednesday August 28, 2024 @05:50AM (#41377772)
What's allowing the AI agent to access files at all in the first place?
[ Parent | on HN ]
Re:Boxxy puts bad Linux applications in a box with only thei... by dmd on Wednesday August 28, 2024 @08:35AM (#41378763)
People ascribe magical powers to them.
[ Parent | on HN ]
Re:Boxxy puts bad Linux applications in a box with only thei... by okasaki on Wednesday August 28, 2024 @06:18AM (#41377935)
Why not docker?
[ Parent | on HN ]