Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> I think you may find that "just get shit done" is even more true for BSD today than it is for Linux

Can I run sandboxed rootless containers on OpenBSD?



Not exactly what you're looking for, but unveil[0, 1] can help fulfill a similar goal.

It looks like Docker has some progress as well, via an alpine VM[2].

I may have misunderstood your question though, I haven't done much with containers.

[0] https://man.openbsd.org/unveil

[1] https://lwn.net/Articles/767137/

[2] https://medium.com/@dave_voutila/docker-on-openbsd-6-1-curre...


Unveil and pledge are great at restricting and effectively sandboxing processes a la a simpler version of Linux's SECCOMP. If you're using namespaces for process isolation or sandboxing, it can do the trick.

They're not a general replacement for Linux's namespaces, though. The only alternative on OpenBSD would be running the alternative environment in a VM, or running Linux in a VM and then using namespaces there.

FreeBSD comes closer with jails, but still doesn't match the ease of which you can use rootless namespaces to e.g. dump a tar file of a rootfs into a directory and "chroot" into it, all without root.

(the OpenBSD world will never implement this sort of thing by design, and it has merits, as user namespaces has created several privilege escalation vulnerabilities over the years, which is one reason some distros like RHEL/CentOS disable it on their kernels)




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: