Hacker News Reader

Comment by codedokode | Hacker News Reader

Note that VS Code is built on Electron and it is a pain to sandbox because Electron has (had?) SUID sandbox helper, and you cannot run SUID binaries in sandbox easily. Sandboxing on Linux is extremely difficult task.

View on HN

It feels so bad to see the "You need go give Chrome SUID Root for the sandbox to work". Setting a Web Browser SUID Root was an old joke about clueless users. It was the worst security screwup someone could imagine.

podman seems to handle rootless namespaces just fine, minor caveat for some perf overhead but it's not the end of the world.

And volumes. Volumes are not fun with podman. Ironically my team tried GitHub Codespaces and never looked back. Super cheap and uses DevContainers.

What's the difference between Podman and docker for volumes? Other than needing to add Z to get volumes to mount with SELinux

Maybe permissions when going rootlesz?

If you're root on a system and use Docker volumes, you can always `sudo ls` and access those volumes outside of the container.

If you're just a user running containers under Podman, it's more tricky.

`podman unshare && podman mount`

Don't build your ide on electron then.

Electron was invented to build an IDE on.

Nothing about that guarantees that it is suitable to the purpose

> Sandboxing on Linux is extremely difficult task.

Which is really insane when you think about it. Plan 9 had this sorted out decades ago.

With no disrespect to the Linux kernel programmers who are vastly better than I’ll ever be.

Plan 9 was designed, Linux accreted.

Reply on news.ycombinator.com