<pie_>
unrelated, stf just posted a small comparison table of minijail nsjail and bubblewrap https://ctrlc.hu/~stef/jails.txt "nsjail can do the most, but minijail is close and there's some things only it can do, bubblewrap can barely do anyting but in return its a fraction of the code."
TheJollyRoger has quit [Remote host closed the connection]
TheJollyRoger has joined #spectrum
<aaronjanse>
I was playing a lot with user namespace sandboxing this weekend, hoping that it'd be easier than Spectrum's approach (spoiler: I don't think it is)
<aaronjanse>
Having the capability to chroot allows you to escape a chroot jail. But applications such as Firefox and Chrome need chroot capability to do their own sandbox for javascript/whatever
<aaronjanse>
Also, it's really easy to have an escape if applications can touch anything like dbus
<aaronjanse>
Still, it looks like a very good step forward compared to the current state of affairs on Linux desktop