A quick look at unprivileged sandboxing

Re:A quick look at unprivileged sandboxing by throw7484485 on Tuesday July 15, 2025 @05:14PM (#44575891)

This has been solved for like 15 years. Use virtual machines!

[ Parent | on HN ]

Re:A quick look at unprivileged sandboxing by simonw on Tuesday July 15, 2025 @05:27PM (#44575986)

Right now on my Mac I use a messy combination of Docker containers, sandbox-exec, bits and pieces of WebAssembly and mostly don't bother at all.

I want the friction on this to be way lower. I'd like everything to run in a sandbox by default.

[ Parent | on HN ]

Re:A quick look at unprivileged sandboxing by fsflover on Tuesday July 15, 2025 @05:50PM (#44576178)

> I want the friction on this to be way lower. I'd like everything to run in a sandbox by default.

You've just described Qubes OS: https://qubes-os.org. My daily driver, can't recommend it enough.

[ Parent | on HN ]

Re:A quick look at unprivileged sandboxing by hsbauauvhabzb on Tuesday July 15, 2025 @11:11PM (#44578315)

Virtual machine escapes exist either due to hypervisor 0day, misconfiguration or lateral attacks.

0day won’t be wasted on low value targets, but it’s worth pointing out that they’re not an effective security boundary in all scenarios.

[ Parent | on HN ]

Re:A quick look at unprivileged sandboxing by pjmlp on Thursday July 17, 2025 @07:41AM (#44592195)

A bit more, considering I was using HP-UX Virtual Vault in 2000.

Note the windows captions on the screenshot.

[ Parent | on HN ]