Lai0chee

You seem to confuse "portable file format" with "horrible designed format". :-)

So, this is the justification for having a horrible file format?

Yessss, just down vote me for sharing my personal opinion.

How do other distros solve this "issue"?

I gave up on Debian after they've renamed Firefox to Iceweasel.

IMHO Debian's problem is not systemd the problem are the crazy politics. :-(

Is systemd now able to work within user namespaces?

BTW: Thanks for downvoting this.

There is a high chance that it will crash your system.

- Unlocked access to ->comm

- What if buf is less than 6 bytes or not NULL terminated?

- Only searching for sys_close() is not enough, it will also find any function pointer to sys_close() and then return a false syscall table.

Anyway, a nice hack. :-)

BTW: Just one example of a typical Linux namespace vulnerability: http://git.kernel.org/cgit/linux/kernel/git/ebiederm/user-na...

Docker is based on Linux namespaces. The first thing which comes to mind is that Docker does not use user namespaces. Hence, the root within Docker is the same root as on the host side. Of course Docker papers over the issue by using apparmor and other tricks but this does not cure the issue itself.

Linux containers (LXC, libvirt-lxc, Docker) are shared kernel visualization. Every single kernel vulnerability will hit you hard.

In contrast to LXC and libvirt-lxc Docker lets you configure a lot of insane setups which are not secure. (But easy to setup) Also keep in mind resource issues. If you setup your container in a wrong way it my eat all your available file descriptors, all memory, etc... (Because it is shared kernel)

Let's face it, the whole technology was not designed for sandboxing, more for easy deployment of applications.

That said, I really love container and use them a lot in production with libvirt-lxc. But I don't use them for sandboxing.

Docker "isolation" is not as strong as most hipsters think. :-)

humm, the sudo makes me shudder.

Is there no at(1) on OSX?

This is the very best thing I've ever seen on this site. :-)

/me has a deja vu.

Looks like this is Transmeta v2. :-)