0

I wonder if there is a kind of a sandboxing solution for linux, sometimes there is more than one app that is candidate to solve my problems, in that case I want to try all of them to get the one which better fit my needs.

Usually I extract .deb files somewhere and export PATH env adding the bin directory and LD_LIBRARY_PATH adding the lib direcotry. Most of the times it works well, but sometimes the application requires /etc configurations, or other resources like images on share folder, that I was not able to solve.

My test machine is old, so I have low resources, a VM would bore me a lot, a separated linux installation in my disk doing chroot would please me better than a VM in performance, but it still takes some unwanted spaces because of repeated files, almost all of them are the same of my original distro.

I was wondering if there is somehow a mixed mount -bind with some magic flag, or other solution, something like the follow:

$ mkdir dir1 dir2
$ echo "Lipsum" > dir1/file1
$ echo "Original" > dir1/file2
$ sudo mount -o bind -some-magic-flag dir1 dir2
$ echo "Changed" > dir2/file2
$ touch dir2/file3
$ ls -1 dir2
file1
file2
file3
# it's ok
$ ls -1 dir1
file1
file2
# file3 sould not be here!
$ sudo umount dir2
$ ls -1 dir2
file2
file3
# file1 was not changed, should not be repeated here, but file2 was
$ cat dir1/file2
Original
$ cat dir2/file2
Changed
  • I assume you read through some of the 3,550,000 results that Google gives for "Linux sandbox" right? – terdon Jan 5 '14 at 17:45
  • @terdon I found this one but I thought it isn't finished yet. – Tiago Pimenta Jan 5 '14 at 17:55
  • 1
    Random google results: one, two and three. – terdon Jan 5 '14 at 17:58
0

My first recommendation would be to switch to BSD and run jail, but I'm assuming you don't want that. So instead I'll recommend Dockers, which is basically a way to isolate an application from the rest of the system.

0

I was possible with overlayfs:

mount -t overlay -o "lowerdir=/original,upperdir=/overlay,workdir=/tmp/workdir" overlay /mnt/target

Where /original is untouched, /overlay is the result of changes on /mnt/target over /original, thus /mnt/target is the result of files in /original plus files in /overlay.

The /tmp/work is a control directory, it is necessary while the mount exists, but it is not necessary to remain after umount.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.