I am biased but BSD jails are waaay more sophisticated than LXC - but even so I see myself renting vas in backspace rather than building my own vas

With very new Linux kernels that have almost all of the user namespace patches merged, there is very little difference. I am curious the technical and not assumed differences however. Note that I donated to the FBSD foundation not because I ever use FBSD, but because in the open source ecosystem, diversity is important. Also, I'm a huge fan of pcc and clang/llvm

Hi Jeff,

Thanks for pointing out virt-sandbox. I wasn't aware of it until now; it looks pretty interesting. Unfortunately the apps I would most like to sandbox, like pdf readers, don't seem likely to work with this approach, since it precludes interaction with X windows.

virt-sandbox does not seem to be available on my Linux distribution (SuSE), so, at least for me, it trivially can't replace jails :) On a more serious note, though, jails seem more appropriate for sandboxing daemon processes than for running one-off commands. I don't think virt-sandbox was designed for this role. In that sense, SELinux is more of a replacement for jails than virt-sandbox.

FYI: virt sandbox created containers are automatically locked down via SELinux[1] so you get the best of both worlds. I do not believe FBSD has a similar information assurance feature akin to SELinux.

[1] http://fedoraproject.org/wiki/Features/Securecontainers