Secure Containerized Browser

vermaden.wordpress.com

24 points·vermaden··10 comments

What is the advantages of this over running a snap contained browser?

Isn't restricting chromium to only ~/Downloads already possible in a regular Linux OS by running chromium inside a chroot?

Perhaps, though with a fair amount of hassle giving it access to device files, shared libraries, dynamically loaded plugins, and so on.

You'd use a portable build.

The easy option is firejail, which ships with premade profiles to give things exactly what they need to run, ex. https://github.com/netblue30/firejail/blob/master/etc/profil...

Sort of. For example:

https://github.com/netblue30/firejail/issues/1950

There are other, similar issues. It's a fair amount of work sussing it all out.

Not really, since ~/Downloads isn't inside a chroot. You accomplish it most easily with AppArmor.

Anyway, OP is telling you how to do it with OpenBSD, which is also a "regular" OS.

Could I do this with Docker on Windows?

There's no fundamental reason you can't since there are X11 clients for windows, which is what this uses. However, FreeBSD jails and Linux containers have very little overhead on their native OS, whereas Docker on Windows runs a Linux VM, so the experience might not be that great. Only way to know though is to try it!

I use Sandboxie plus on Windows, easy to set-up, found no faults yet

Reply on news.ycombinator.com