6 ms·
Maybe you can use docker instead? http://fabiorehm.com/blog/2014/09/11/running-gui-apps-with-docker/ http://fabiorehm.com/blog/2014/09/11/running-gui-apps-with
by vojant 11y ago
Maybe you can use docker instead?
http://fabiorehm.com/blog/2014/09/11/running-gui-apps-with-docker/ http://fabiorehm.com/blog/2014/09/11/running-gui-apps-with-d...
https://blog.jessfraz.com/post/docker-containers-on-the-desktop/ https://blog.jessfraz.com/post/docker-containers-on-the-desk...
- aw3c2 11y agoI was told docker runs things as root and is not secure, just convenient.
- amouat 11y agoThere's no reason a Docker container has to run as root. The daemon does, but that's another issue.
- audidude 11y agoIf you are connecting to X, it doesn't matter. You can attack all other X11 clients by design. This is why GNOME is pushing so heavily on xdg-app (for the sandbox) and the wayland-enabled GNOME shell (so apps can't snoop on each other).
- anthk 11y agoWayland doesn't have the Xinput disaster.
- timthelion 11y agoSubuser uses XPRA, so it shouldn't suffer from this problem: http://subuser.org/news/0.3.html#the-xpra-x11-bridge http://subuser.org/news/0.3.html#the-xpra-x11-bridge
- amouat 11y agoThere's actually a project called Subuser https://github.com/subuser-security/subuser https://github.com/subuser-security/subuser which uses Docker to secure desktop applications.
- vojant 11y agoThanks for sharing, this looks interesting.
- InsideTheBox 11y agoX11 forwarding doesn't cause any problems? I imagine I would easily be running 6 sandboxed apps at the same time. From what I heard you can escape docker anyway so I would need something like SubUser (suggested by amouat)
- LinuxBender 11y agoDocker is just a container and not a sandbox. There are no controls in the kernel to prevent something from leaving the container unless you enable restrictions outside of docker such as SELinux. There is a lot of development around SELinux+Docker right now.