Get the latest tech news
A quick look at unprivileged sandboxing
- git - desktop - images - contact 2025-07-13 Disclaimer: This is to the best of my knowledge. It's a complicated topic, there are tons of options, and this only covers a tiny fraction of this topic anyway.
Both pledge() and unveil() are used in OpenBSD's base system in a lot of places, all the way down to tools like ps or tee. In essence, if unprivileged sandboxing was as complicated as this, I, personally, would only use it in very specific scenarios where it's absolutely needed. To write the following program, I studied the output of strace bwrap ... and also read some of Bubblewrap's source code.
Or read this on Hacker News
