I wonder if there is a kind of a sandboxing solution for linux, sometimes there is more than one app that is candidate to solve my problems, in that case I want to try all of them to get the one which better fit my needs.

Usually I extract .deb files somewhere and export PATH env adding the bin directory and LD_LIBRARY_PATH adding the lib direcotry. Most of the times it works well, but sometimes the application requires /etc configurations, or other resources like images on share folder, that I was not able to solve.

My test machine is old, so I have low resources, a VM would bore me a lot, a separated linux installation in my disk doing chroot would please me better than a VM in performance, but it still takes some unwanted spaces because of repeated files, almost all of them are the same of my original distro.

I was wondering if there is somehow a mixed mount -bind with some magic flag, or other solution, something like the follow:

$ mkdir dir1 dir2
$ echo "Lipsum" > dir1/file1
$ echo "Original" > dir1/file2
$ sudo mount -o bind -some-magic-flag dir1 dir2
$ echo "Changed" > dir2/file2
$ touch dir2/file3
$ ls -1 dir2
# it's ok
$ ls -1 dir1
# file3 sould not be here!
$ sudo umount dir2
$ ls -1 dir2
# file1 was not changed, should not be repeated here, but file2 was
$ cat dir1/file2
$ cat dir2/file2
  • I assume you read through some of the 3,550,000 results that Google gives for "Linux sandbox" right?
    – terdon
    Jan 5, 2014 at 17:45
  • @terdon I found this one but I thought it isn't finished yet. Jan 5, 2014 at 17:55
  • 1
    Random google results: one, two and three.
    – terdon
    Jan 5, 2014 at 17:58

2 Answers 2


My first recommendation would be to switch to BSD and run jail, but I'm assuming you don't want that. So instead I'll recommend Dockers, which is basically a way to isolate an application from the rest of the system.


I was possible with overlayfs:

mount -t overlay -o "lowerdir=/original,upperdir=/overlay,workdir=/tmp/workdir" overlay /mnt/target

Where /original is untouched, /overlay is the result of changes on /mnt/target over /original, thus /mnt/target is the result of files in /original plus files in /overlay.

The /tmp/work is a control directory, it is necessary while the mount exists, but it is not necessary to remain after umount.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .