Server-side sandboxing: Containers and seccomp
I haven't used seccomp, but have recently been playing around with the Linux pledge port[1]. It has a very friendly UI, but I still struggled with allowing some complex apps to run at all, because of the sheer amount of syscalls and devices they required. Digging through a mountain of strace output is tedious...<p>Can someone with experience with both comment on how (the Linux port of) pledge compares to seccomp? Can it be considered a replacement at this point?<p>It seems like it could handle the last scenario described in the article fine, since it allows setting granular rwcx permissions on individual paths.<p>[1]: <a href="https://justine.lol/pledge/" rel="nofollow noreferrer">https://justine.lol/pledge/</a>