NsJail: A light-weight process isolation tool for Linux
1–10 of 30 posts
Re: NsJail: A light-weight process isolation tool for Linux
#2it'd be interesting to see a comparison of these -- the building blocks are (mostly) the same, but the interfaces differ in interesting ways:
- nsjail
- firejail
- bubblewrap
- runc
etc.
Re: NsJail: A light-weight process isolation tool for Linux
#3it'd be interesting to see a comparison of these -- the building blocks are (mostly) the same, but the interfaces differ in interesting ways: - nsjail - firejail - bubblewrap - runc etc.
And jailer from firecracker and systemd itself which has some similar capabilities
Re: NsJail: A light-weight process isolation tool for Linux
#4it'd be interesting to see a comparison of these -- the building blocks are (mostly) the same, but the interfaces differ in interesting ways: - nsjail - firejail - bubblewrap - runc etc.
Me too, for me the ease of use is rather important. NSJail is very easy to use, I am not sure which ones I tried when looking for these tools but some of them were an absolute pain to get going.
Edit: funnily, chatgpt 03-mini tells me nsjail is the second hardest to use (first = systemd) of these...
Re: NsJail: A light-weight process isolation tool for Linux
#5A few decades back we had the ability to cryogenically freeze processes, save them to storage, move the bins to another system, and defrost them to be run again. This was a great feature that I had hoped would make its way into mainstream kernels, but it seems to have disappeared off the face of the earth.
I wonder if the expansion of process isolation tooling will ever lead us back to this situation again, anyone know? It seems to me that strict isolation would be a vital rudimentary requirement for cryofreezing processes...
Re: NsJail: A light-weight process isolation tool for Linux
#6A few decades back we had the ability to cryogenically freeze processes, save them to storage, move the bins to another system, and defrost them to be run again. This was a great feature that I had hoped would make its way into mainstream kernels, but it seems to have disappeared off the face of the earth. I wonder if the expansion of process isolation tooling will ever lead us back to this situation again, anyone kn…
You might be looking for CRIU (https://criu.org/) - it works perfectly on the current kernel.
Re: NsJail: A light-weight process isolation tool for Linux
#7A few decades back we had the ability to cryogenically freeze processes, save them to storage, move the bins to another system, and defrost them to be run again. This was a great feature that I had hoped would make its way into mainstream kernels, but it seems to have disappeared off the face of the earth. I wonder if the expansion of process isolation tooling will ever lead us back to this situation again, anyone kn…
Yeah there is some capability for this, for example https://criu.org
Re: NsJail: A light-weight process isolation tool for Linux
#8A few decades back we had the ability to cryogenically freeze processes, save them to storage, move the bins to another system, and defrost them to be run again. This was a great feature that I had hoped would make its way into mainstream kernels, but it seems to have disappeared off the face of the earth. I wonder if the expansion of process isolation tooling will ever lead us back to this situation again, anyone kn…
A bit of tangent, but reminds me of the Deep Freeze Windows app: https://www.faronics.com/products/deep-freeze
I wonder if a similar tool exists for Linux.
Re: NsJail: A light-weight process isolation tool for Linux
#9A few decades back we had the ability to cryogenically freeze processes, save them to storage, move the bins to another system, and defrost them to be run again. This was a great feature that I had hoped would make its way into mainstream kernels, but it seems to have disappeared off the face of the earth. I wonder if the expansion of process isolation tooling will ever lead us back to this situation again, anyone kn…
A bit of tangent, but reminds me of the Deep Freeze Windows app: https://www.faronics.com/products/deep-freeze I wonder if a similar tool exists for Linux.
Guest user account??
Re: NsJail: A light-weight process isolation tool for Linux
#10it'd be interesting to see a comparison of these -- the building blocks are (mostly) the same, but the interfaces differ in interesting ways: - nsjail - firejail - bubblewrap - runc etc.
As a bubblewrap user, beware https://github.com/containers/bubblewrap/pull/586 still missing. The usual ^C doesn't work with your sandboxed stuff, very annoying.
A cursory look at NSjail tells me its filesystem stuff is less granular than bwrap's bind mounting.
Firejail can't handle : in some paths (at all, no escaping provided) which made me dump it.