Server-side sandboxing: Containers and seccomp
I haven't used seccomp, but have recently been playing around with the Linux pledge port[1]. It has a very friendly UI, but I still struggled with allowing some complex apps to run at all, because of the sheer amount of syscalls and devices they required. Digging through a mountain of strace output is tedious...Can someone with experience with both comment on how (the Linux port of) pledge compares to seccomp? Can it be considered a replacement at this point?It seems like it could handle the last scenario described in the article fine, since it allows setting granular rwcx permissions on individual paths.[1]: https://justine.lol/pledge/