Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NsJail: A light-weight process isolation tool for Linux

nsjail.dev

Post reply on HN
Print view View original

11–20 of 30 posts

Re: NsJail: A light-weight process isolation tool for Linux

#12

Post by kennysoona »

yamrzou wrote: post #11
5- wrote: post #2

it'd be interesting to see a comparison of these -- the building blocks are (mostly) the same, but the interfaces differ in interesting ways: - nsjail - firejail - bubblewrap - runc etc.

And pledge(): https://justine.lol/pledge/

pledge is the openbsd version of landlock, a pretty different category from the other namespace based solutions listed.

Re: NsJail: A light-weight process isolation tool for Linux

#13

Post by bjackman »

kennysoona wrote: post #12
yamrzou wrote: post #11

Earlier quoted context omitted.

And pledge(): https://justine.lol/pledge/

pledge is the openbsd version of landlock, a pretty different category from the other namespace based solutions listed.

It's still a reasonable comparison though. The seccomp-bpf is part of nsjail is achieving the same thing, one way to look at it is that Landlock/pledge are just a better implementation for the same approximate feature.

Re: NsJail: A light-weight process isolation tool for Linux

#14

Post by kennysoona »

bjackman wrote: post #13
kennysoona wrote: post #12

Earlier quoted context omitted.

pledge is the openbsd version of landlock, a pretty different category from the other namespace based solutions listed.

It's still a reasonable comparison though. The seccomp-bpf is part of nsjail is achieving the same thing, one way to look at it is that Landlock/pledge are just a better implementation for the same approximate feature.

I don't really find it reasonable, landlock type functionality is a tiny subset of what namespace based sandboxing offers. It's like comparing a scanner to authenticate ID cards against a fortified house.

Re: NsJail: A light-weight process isolation tool for Linux

#15

Post by bjackman »

kennysoona wrote: post #14
bjackman wrote: post #13

Earlier quoted context omitted.

It's still a reasonable comparison though. The seccomp-bpf is part of nsjail is achieving the same thing, one way to look at it is that Landlock/pledge are just a better implementation for the same approximate feature.

I don't really find it reasonable, landlock type functionality is a tiny subset of what namespace based sandboxing offers. It's like comparing a scanner to authenticate ID cards against a fortified house.

Oh yeah I was just talking specifically about the seccomp-bpf bit. It's not comparable to nsjail as a whole.

Re: NsJail: A light-weight process isolation tool for Linux

#16

Post by bjackman »

losfair wrote: post #6
aa-jv wrote: post #5

A few decades back we had the ability to cryogenically freeze processes, save them to storage, move the bins to another system, and defrost them to be run again. This was a great feature that I had hoped would make its way into mainstream kernels, but it seems to have disappeared off the face of the earth. I wonder if the expansion of process isolation tooling will ever lead us back to this situation again, anyone kn…

You might be looking for CRIU ( https://criu.org/ ) - it works perfectly on the current kernel.

IIUC this even has logic to reconstitute TCP connections - https://criu.org/TCP_connection
Post reply on HN