Get the latest tech news
NsJail: A light-weight process isolation tool for Linux
A light-weight process isolation tool, making use of Linux namespaces and seccomp-bpf syscall filters (with help of the kafel bpf language)
Programmable seccomp-bpf syscall filters(through the kafel language) Cloned and isolated Ethernet interfaces Cgroups for memory and PID utilization control Isolation with access to a private, cloned interface (requires root/setuid) PS: You’ll need to have a valid file-system tree in/chroot. A more complex setup, which utilizes virtualized (cloned) Ethernet interfaces (to separate it from the main network namespace), can be found in configs/firefox-with-cloned-net.cfg.
Or read this on Hacker News