Every story and comment from the Hacker News API, in a layout borrowed from 2001.
A comment on Landrun: Sandbox any Linux process using Landlock, no root or containers. Parent comment
I think nsjail uses mount namespaces (CLONE_NEWNS) instead of landlock for filesystem sandboxing, but what would the practical differences be?
There are no comments on this comment yet.
I think nsjail uses mount namespaces (CLONE_NEWNS) instead of landlock for filesystem sandboxing, but what would the practical differences be?