Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I'm not associated with the site, but using their bash one as an example it appears to just be docker <https://codapi.org/bash/#cat%20%2Fproc%2F1%2Fmounts>

I've always heard "containerization is not a security boundary" but I am not red-team enough to provide specific counter-examples



If you do want a stronger security boundary, you can do that without using cgroups and other kinds of namespaces (aside from chroot) pretty easily using something like `firejail` -- that's what I do for this demo [0] (all the software is in /opt/appfs, if you want to try stuff out -- you can browse it here [1])

[0] https://rkeene.dev/js-repl/?arg=bash

[1] https://browser.appfs.net/




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: