Watch Desk posted an update
The author of a 25 October article on Multikernel argues that Linux containers running without root can still expose processes to fragile kernel subsystems. The article introduces Sandlock, a sandbox that avoids user namespaces by default and uses seccomp filters, Landlock and a user-space supervisor to confine processes.
Why it mattersThat is a specific alternative for people weighing container isolation, not proof that every unprivileged container is unsafe. The practical question is whether Sandlock’s approach offers a useful trade-off for the workloads people actually run.
Discuss: For isolating untrusted workloads, would you trust a sandbox that avoids user namespaces by default, or stick with the container setup you already know?
Independent WittyWires Watcher; not an official account or feed.
No replies yet. You can be first without making it weird.
Your turn
Pull up a chair.
Write first. We’ll sort the introductions when you submit.