Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Toolship: A more secure workstation

yann.pt

Post reply on HN
Print view View original

11–20 of 59 posts

Re: Toolship: A more secure workstation

#11

Post by ritchiey »

I have the same concern. Something might be worth looking into is replacing docker with Podman because it runs as the authenticated user rather than using a daemon running as root. Also, I believe Podman desktop allows for multiple VMs.

Also consider QubesOS. Where everything runs in a VM (if you can find appropriate hardware on which to run it).

Less flexible but easier to install is ChromeOS FLEX (or a high end Chromebook). Like QubesOS, ChromeOS lets you run Linux in a VM but with the ability to open native windows.

Re: Toolship: A more secure workstation

#12

Post by mr-karan »

Interesting approach to maintaining a clean dev environment using containers. This approach reminds me of Fedora Silverblue[1] that I’ve been wanting to try. It leverages OSTree for atomic upgrades and rollbacks. Users can run containers for CLI utils using toolbox[2]. This way, the base OS remains pristine, and there's less risk of "dependency hell" or inadvertent “package upgrades gone wrong”.

[1]: https://fedoraproject.org/silverblue/

[2]: https://docs.fedoraproject.org/en-US/fedora-silverblue/toolb...

Re: Toolship: A more secure workstation

#14

Post by imiric »

Docker seems a bit unwieldy for this use case. Given it runs in a Linux VM on macOS, wouldn't all these commands have considerable overhead?

On Linux, the pledge utility[1] seems like a better fit for this. I'm not aware of what the macOS alternative would be, but considering this functionality stems from OpenBSD, maybe it can be ported to Darwin?

[1]: https://justine.lol/pledge/

Re: Toolship: A more secure workstation

#17

Post by chris37879 »

ritchiey wrote: post #6
coreyh14444 wrote: post #3

WSL is quite good for this type of thing.

WSL probably is good but I believe it still has access to the whole Windows file system. Linux on ChromeOS is probably better because its file system is separate. Files and directories must be explicitly shared from the main OS. I think both have the ability to open windows on the main desktop so you can run graphical IDEs and the like in the VM which is nice.

The filesystem access is optional and can be removed, WSL2 is actually a fairly nice implementation of a linux sandbox that can be used like it's just running alongside windows. I think your concern is valid for WSL1, where the seperation is managed by a Microsoft provided Windows driver, but WSL2 is just a VM with dynamic memory allocation, so you can lock it down basically as well as any other Hyper-V VM, it just has a lot of integrations enabled by default.

Re: Toolship: A more secure workstation

#18

Post by llimllib »

DavyJone wrote: post #5

You might enjoy https://github.com/jessfraz/dotfiles/blob/master/.dockerfunc I think she had an article about this as well.

https://blog.jessfraz.com/post/docker-containers-on-the-desk... is the one I remember, a bit old but still useful to see how she does it.

Seems super painful and indirected for a nebulous gain to me, but find your joy however you want I guess

Re: Toolship: A more secure workstation

#19

Post by mongol »

I have been thinking how to work with multiple users in a convenient way. The problem is that file permissions causes problems when you want to switch between users. I have not found a really ideal way of working using different users, but I think it needs some approach, I just haven't found it yet.
Post reply on HN