Easy Sandboxing on Linux with Bubblewrap
6 points by FedericoSchonborn
6 points by FedericoSchonborn
People looking for a lightweight and versatile sandbox-like tool for Linux should check out try.
It executes a command in a simulacrum of your real system and presents its filesystem effects for you inspect/apply/discard.
Please note that try is a semisolate (as opposed to a sandbox)
Pet peeve: the sandbox metaphor doesn't imply impermeability. Real-life sandboxes have a low edge that the children can just step over.
If you want to imply secure isolation, maybe go for another metaphor like "container" or "jail".
I appreciate this write-up, but I wouldn't describe a solution that requires constantly tweaking a 150+ line bash script as "easy."