TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Bubblewrap: Unprivileged sandboxing tool

91 点作者 groks将近 9 年前

4 条评论

cyphar将近 9 年前
For those interested in OCI-compatible runtimes, I&#x27;m currently implementing rootless containers for runC[1]. This would allow you to get the same sort of unprivileged sandboxing but with a popular container runtime.<p>[1]: <a href="https:&#x2F;&#x2F;github.com&#x2F;opencontainers&#x2F;runc&#x2F;pull&#x2F;774" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;opencontainers&#x2F;runc&#x2F;pull&#x2F;774</a>
icefox将近 9 年前
Looks neat, but just like the firejail guys they really need to work on their tutorial&#x2F;readme&#x2F;docs&#x2F;manpage.<p>Many users including myself who want to play around with it get stuck trying to do basic stuff. My first try was using bwrap (not bubblewrap!) to wrap true provides this not very helpful error.<p><pre><code> $ bwrap true execvp true: No such file or directory </code></pre> Looking in the webpage I see that this is what I want works<p><pre><code> ~$ bwrap --ro-bind &#x2F; &#x2F; true </code></pre> Is this what I want to do? I am not sure, maybe I want to expose just &#x2F;bin&#x2F;true, but I couldn&#x27;t figure that out. It may be using --symlink, but the docs give no hint as to what symlink actually does. Where does it make a symlink? And when would I use it?<p><pre><code> --symlink SRC DEST Create a symlink at DEST with target SRC </code></pre> Getting the default behavior right is important as is helping the user, especially for a security tool. bwrap is a tool that wraps other tools so you would expect that if I did &#x27;$bwrap true&#x27; than it would create an empty fs, expose the one binary it is going to try to run and then run it. Otherwise it is tempting to insert the following alias which may or may not be a bad security practice.<p><pre><code> bubblewrap=`bwrap --ro-bind &#x2F; &#x2F;` </code></pre> firejail gets this somewhat right where you can do &#x27;firejail --quiet -- true&#x27; and it just works (although the fact that I have to use --quiet and it still spits out a \n is both sad and embarrassing)<p>Both projects should want to provide tools to help users accomplish the most common cases in a secure manor such as: access to 1 file, 1 directory, network access. As a user my goal isn&#x27;t to use firejail it is to accomplish something else so the fact that firejail wants to spit out a bunch on stdout is a really weird design choice.<p>As a user I would want to do the following:<p><pre><code> bwrap --rofile foo.txt -- file bwrap --rodir foo&#x2F; -- ls bwrap --net -- curl</code></pre>
评论 #12256769 未加载
zmanian将近 9 年前
I&#x27;ve been wanting something like this to sandbox build systems like npm, cargo etc so you can be sure your dependency resolution can&#x27;t exfiltrate your keys.
otoburb将近 9 年前
The term &quot;bubble wrap&quot; looks like it is still trademarked[1], even though it&#x27;s commonly used as a generic term. Hopefully this flies under Sealed Air&#x27;s radar. I often wonder how far organizations will go to protect physical brands as the world rapidly digitizes.<p>[1] <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;List_of_generic_and_genericized_trademarks#List_of_protected_trademarks_frequently_used_as_generic_terms" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;List_of_generic_and_genericize...</a>
评论 #12249129 未加载
评论 #12245219 未加载