6 ms·
The other day I saw this: https://nono.sh/ https://nono.sh/ Haven't tested it yet, but it seems to address the same issue as Docker Sandboxes, but in a differe
by dethos 1mo ago
The other day I saw this: https://nono.sh/ https://nono.sh/
Haven't tested it yet, but it seems to address the same issue as Docker Sandboxes, but in a different way.
- speedgoose 1mo agoI have tested it and the big advantage is that is has access to the local development tools. But it’s not as well sandboxed for sure.
- LeBit 1mo agoWhy do you say that? Eg, if used with Colima in macOS, it means I can run a devcontainer in an isolated VM and Nono inside the devcontainer can restrict a lot what can and cannot be done. You get credentials proxying and network outbound limits. How is Docker Sandbox better sandboxed?
- speedgoose 1mo agoYeah but that’s Colima and Nono then. Not only Nono.
- isityettime 1mo agoTrue. But it's also an illustration of how relying on an OS' native sandboxing capabilities is nicely composable with other isolation techniques.
- fg137 1mo agoAs you as your Go build fails because you haven't put the local cache dir in the "allowed directories", you'll understand how painful this is, as well as most tools based on bubblewrap/sandbox-exec. There is a difference between a clean environment with standard setup vs a layer on top of everyone's existing tools/setup, especially in a enterprise environment. (I'm sure you can spend time to come up with a proper bubblewrap configuration that allows go build to succeed, but it's probably not worth the effort.)
- lemontheme 1mo agoNono has been my daily driver since the start of the year. It's not a perfect sandbox -- that's for sure. For example, the default network rules let you escape via a global TMUX server. But it is extremely practical. It gives me enough guarantees to feel confident about running in YOLO mode. So far nothing has gone awry.