[dead]
Show HN: Zerobox – Sandbox any command with file, network, credential controls
91–100 of 108 posts
Re: Show HN: Zerobox – Sandbox any command with file, network, credential controls
#92Re: Show HN: Zerobox – Sandbox any command with file, network, credential controls
#93Oh wow, this looks nicely done! It's also nice that it's cross platform. I've done something similar with https://github.com/Gerharddc/litterbox which takes things a bit further by allowing you to easily sandbox your entire development environment (i.e. IDE and everything) using containers. Unfortunately I have not gotten around to the network sandboxing part though, that seems very tricky to get useful without being too "annoying".
Re: Show HN: Zerobox – Sandbox any command with file, network, credential controls
#94Oh wow, this looks nicely done! It's also nice that it's cross platform. I've done something similar with https://github.com/Gerharddc/litterbox which takes things a bit further by allowing you to easily sandbox your entire development environment (i.e. IDE and everything) using containers. Unfortunately I have not gotten around to the network sandboxing part though, that seems very tricky to get useful without being…
Thanks for sharing this. I really like the idea
Re: Show HN: Zerobox – Sandbox any command with file, network, credential controls
#95Earlier quoted context omitted.
Give me 2 days :)
The `--build-profile` / `--profile` thing is a good idea, but typically you'd want to just save all of the access that the program does without prompting. Programs will access many files and directories on startup, and it would be extremely tedious to have to manually approve each one. So you'd auto-approve all and save them to the profile. This is TOFU principles applied to sandboxing. The assumption being that "thi…
I agree. What would be the ideal DX from your point of view?
Re: Show HN: Zerobox – Sandbox any command with file, network, credential controls
#96Re: Show HN: Zerobox – Sandbox any command with file, network, credential controls
#97This is really useful! How well does it compare though to Docker etc. Because I am worried about sandbox escapes. This is what we currently use to sandbox JS inside Browsers and Node (without anything extra) : https://github.com/Qbix/Platform/blob/main/platform/plugins/... I like tools like this, but they all seem to share the same underlying shape: take an arbitrary process and try to restrict it with OS primitives…
[dead]
Re: Show HN: Zerobox – Sandbox any command with file, network, credential controls
#98Earlier quoted context omitted.
The `--build-profile` / `--profile` thing is a good idea, but typically you'd want to just save all of the access that the program does without prompting. Programs will access many files and directories on startup, and it would be extremely tedious to have to manually approve each one. So you'd auto-approve all and save them to the profile. This is TOFU principles applied to sandboxing. The assumption being that "thi…
I agree. What would be the ideal DX from your point of view?
The DX above from @simonw seems perfectly fine.
Let the user play with the app and after they exit the profile should contain all of the access attempts in a human readable format that's editable by the developer.
There might be many access attempts to folders in one directory, e.g.:
~/Documents/...
So instead of having a massive list of files it should be easy for developers to edit the profile to say, "Allow everything there", e.g. ~/Documents/*
Re: Show HN: Zerobox – Sandbox any command with file, network, credential controls
#99Earlier quoted context omitted.
What if the program doesn’t respect those env vars? Can Zerobox still block network calls in that case?
Great question! On Linux, yes, network namespaces enforce that and all net traffic goes through the proxy. Direct connections are blocked at the kernel level even if the program ignores proxy env vars, but I will test this case a bit more (unsure how to though, most network calls would respect HTTPS_PROXY and other similar env vars). That being said, the default behaviour is no network, so nothing will be routed if i…
Does this work inside of Podman containers?
Re: Show HN: Zerobox – Sandbox any command with file, network, credential controls
#100Very cool. Is there a way to have a notion of a session, saving state between runs?
No, it's stateless right now. What is your requirement though? How do you define a session? Are you referring to "snapshotting" between sessions?
I'm adding snapshotting as well https://github.com/afshinm/zerobox/pull/21
Then you can run:
```
zerobox --snapshot -- sh -c 'echo "abc" > a'
```
and also `zerobox snapshot list/diff/restore`