9 ms·

Can anyone share a use case or two, for this or in general for this kind of service isolation?

• e12e 5y ago
  I'd love to see some examples, too. Would it be useful for a two-stage email setup for example, where something like postfix or opensmtpd was exposed to the internet, and a richer mail service (with more attack surface) was confined to a vfr, and only the "outer" service listen on smtp to the internet, and forward via LMTP to the "inner" service for example?
• zamadatix 5y ago
  In general if you do it with a namespace you could probably have done it with a lightweight VRF instead. If VRFs hadn't taken nearly a decade to land in the kernel you'd probably see these much more commonly used. Another use case from the original network reason VRFs were made would be conflicting IP space or hanging a single physical device connected to multiple disparate local networks.