Docker containers on the desktop

Re:Docker containers on the desktop by zobzu on Sunday February 22, 2015 @01:06AM (#9088446)

If you break the app you have +- the same access.. see if you break irssi you're not root either.

This stuff is only sort-of reliable when-containers-dont-have-root-bug-today if you run that as a separate user than yourself in a different X server

So basically not cool.

The way GNOME is doing ACTUAL sandboxing is much neater. Turns out it doesn't use Docker also. Go figure /sarcasm.

[ Parent | on HN ]

Re:Docker containers on the desktop by koffiezet on Tuesday February 24, 2015 @08:26AM (#9100348)

Gnome sandboxing uses exactly the same technologies behind the scenes as Docker uses: cgroups, namespaces, ... They add the additional requirement that they need Wayland to circumvent the security issues that X11 presents them. Other than that, you could do it just the same way.

So your "when-containers-dont-have-root-bug-today" applies to Gnome too...

Also: there is no such thing as 'actual' sandboxing. There are many forms of sandboxing, containers (not docker-exclusive, as Gnome is using it exactly the same way) is one form, but we also know Virtual Machines, the Java VM, Javascript in a browser, ... the list goes on - all meaning the same thing: shield an application from everything else on the computer and try to prevent it from breaking out.

[ Parent | on HN ]