[dead]
Launch HN: Freestyle – Sandboxes for Coding Agents
181–182 of 182 posts
Re: Launch HN: Freestyle – Sandboxes for Coding Agents
#182Earlier quoted context omitted.
What does this protect you from that you’re exposed to by running a well-crafted rootless container on a system with SELinux or similar?
Generally kernel level attacks and neighbor performance impacts on the security side. On the functional side without a kernel per guest you can't allow kernel access for stuff like eBPF, networking, nested virtualization and lots of important features. Here is a good blog from docker explaining how even the best container is not as safe as a MicroVM https://www.docker.com/blog/containers-are-not-vms/ theoretically yo…
I think eBPF is a valid example, because it allows you to program the kernel to some extent. That being said and assuming it's not important to your individual goal, why is a rootless podman container running rootless podman inside the container still not sufficient? Do you really need nested virtualization? What are some of those other important features?