Hacker News Reader

Yes. The sandbox tool used by Flatpak is "bubblewrap", which has an overview here: https://github.com/projectatomic/bubblewrap/blob/master/READ...

There is nothing against Flatpak using user namepsaces when the developers feel a bit more comfortable with that, though.

View on HN

Bubblewrap supports user namespaces and has for a while -- grep through the source for CLONE_NEWUSER. I talk about the security concerns a bit in [1].

[1]: https://news.ycombinator.com/item?id=18181034

Are you one of the developers/speaking for them? That warning is pretty old.

Creation of user namespaces still has caused security vulnerabilities in very recent history. But with seccomp you can disable it inside a container (which is what Docker and LXC do by default for instance), and it doesn't make sense to be worried about that as a container runtime because you are using it to increase the security of your sandbox.

Reply on news.ycombinator.com