Hacker News Reader

>Without containers every p0wned process has full access to $HOME and can do everything the user is capable of.

You presume such a thing can happen. You must be a Windows users with no Unix experience. Your comment gives you away. No experienced Unix user, even most beginners, would say such a thing.

View on HN

If I run a shell script under my user account, that shell script has full access to anything my account has access to, UNLESS I'm running SELinux or something like that.

And another Windows user who runs "p0wned" shell scripts on his system. Or believe everyone does this on a regular basis. "Just like Windows!"

Sigh. Yes, I'll assume you're perfect and never run anything you didn't write yourself.

Edit: Okay, think about it this way - if you're the perfect sysadmin who doesn't run anything bad, how do you go about protecting your non-so-perfect users? How do you protect the server you're tasked to maintain?

Just go do a wget site | sh for me will you?

Thanks.

Afterwards we can discuss UNIX security models.

Reply on news.ycombinator.com