#gvisor β Public Fediverse posts
Live and recent posts from across the Fediverse tagged #gvisor, aggregated by home.social.
-
#GVisor supports only x86_64, arm64 yet they claim they run everywhere. #Sydbox passes tests on x86_64, i686, x32, arm64, armv7, ppc64, ppc64le, ppc, s390x, loongarch64, mips64el, and mipsel but I won't claim we are portable until we have mips64, mips, m68k and sparc! Huge thanks to Compile Farm people for enabling us to test Syd on various different architectures! #exherbo #linux #security
-
#gVisor recently got its own #ASLR implementation. OTOH, #Sydbox uses ASLR provided by the #Linux #kernel and enforces PIE executables. #HardenedBSD has a sysctl to enforce PIE as well: https://man.exherbo.org/syd.7.html#Enforcing_Position-Independent_Executables_(PIE) #exherbo #linux #security
-
π So, here's 18 minutes of pure geeky bliss where we pretend #sandboxing is as thrilling as bungee jumping. ποΈ Let's endlessly list things like namespaces, #cgroups, and #gVisor while forgetting that 99% of readers are now asleep. π΄ Keep your kernels close, folks, because apparently, theyβre the rockstars of this yawn-fest. πΈ
https://www.shayon.dev/post/2026/52/lets-discuss-sandbox-isolation/ #geekybliss #techhumor #HackerNews #ngated -
To compare #sydbox and #gvisor, take 2 CVEs: CVE-2018-19333, gvisor proc2proc arbitrary-memory-write which wasn't classified as sandbox break. Vuln is there because gvisor uses the seccomp-trap API to run all in a single process ignoring ASLR.. CVE-2024-42318 aka Houdini is a #landlock break where a keyrings(7) call would unlock the sandbox. Syd wasn't affected: 1. keyrings is def disabled 2. open call happens in a syd emulator thread confined by same landlock sandbox. #exherbo #linux #security
-
Would you be interested in cooperating to build the next #dangerzone #flatpak #snap #ai/#gpu #rustlang #sandbox (insert-hype-here) based on #sydbox rather than #bubblewrap #firejail #snap-confine #gvisor (insert-sandbox-here)? We have #sydbox the application kernel, pandora the automatic profile writer, and syd-tui as a basic tui frontend using #ratatui, however we lack more practical tooling for wider adoption. Dreams, ideas, plans, all sorts of feedback, and contributions are equally welcome!
-
> The foundation of #nabla containers lies in three main components: rumpkernel, solo5, and runnc.
There is an interesting intersection between the approaches of this thing, #binctr , #gvisor and other mixes of virtualization and containerization, both from the artifact/distribution perspective and from the isolation perspective. I wonder where the consensus (if any) will end up in a few years.
runnc, like the others listed above, is an OCI image runner.
blog.cloudkernels.net/posts/naβ¦