Hacker News Reader

Unveil has no way to change the existing structure of the filesystem. With chroot it's easy: create the structure you want in a subdirectory and then chroot into it

View on HN

If changing a process root directory is really what you want to do then yes chroot is the right tool for the job. But from a perspective of "jailing" daemons as mentioned in the article I think unveil is a better API.

I'm not sure what pieces of software populate directories and then chroot into them aside from maybe some build systems? But those likely create or bind in some /dev and /proc pieces which would be privileged operations anyway. And in such a case would containers not have surplanted chroot?

"Jailing" isn't necessarily just about security, but isolation in general. Unveil would be a stronger tool if the concern is strictly security, but also there's no reason they couldn't both be used.

Chroot is itself sometimes used to provide container-style functionality, so I think it's wrong to say containers "surplanted" it.

> And in such a case would containers not have surplanted chroot?

Containers use chroot

They don't use fs namespaces?

Reply on news.ycombinator.com