Hacker News Reader

I've used Wine occasionally, and I like how it has its own file space - everything lives in a directory that kinda looks like Windows. But I've always wondered, does it provide isolation? Does Wine function as a container? Or do executables have full system access?

And does anyone have a good summary of the 32 bit executable story? Those are always problematic on Ubuntu but I never had a clear picture as to why

View on HN

No, Wine is not a container. The Windows application is free to make any Linux syscall with the privileges of the user running Wine. You shouldn't run an untrusted application in Wine any more than you would do for regular Linux applications.

Every program I've run under Wine has read/write access to any directory you own. AFAIK the only way to containerize Wine is via OS-level LXC/Jails/etc, but under X11 that still leaves the GUI wide open unless you have your own X11 stack in the container and run remote desktop or something (which is possible! You can even use VirGL for 3D accel.) Not sure about Wayland, probably still a good idea to have an isolated stack.

It'd be cool if they made that easier to do via Wine itself, but that's probably a bit out of scope.

Reply on news.ycombinator.com