3

First, for this post, I'm using the term sandbox to really mean separation of filesystem changes only. Neither of these methods would: isolate processes in the sandbox from interacting with other processes; prevent breaking out of the chroot; etc. I'm the only user, so I'm not trying to keep untrusted users sandboxed. And, I'm not running untrusted software.

I've been using the overlay filesystem on root, and chroot'ing to its merged directory, to have everything inside the chroot act as if it's in a sandbox.

Can I use btrfs this way, so different shells can be on different snapshots? (i.e. mount a root snapshot to /sandbox-mnt then chroot to it?)

(I understand by doing either, I'm taking the risk of concurrency-type issues. I am pretty strict about only making sandboxes for things that don't happen outside of the sandbox.)

I think this might be also possible using the seeding capabilities?

2

Snapshots, like all btrfs subvolumes, have a path. If you mount the parent subvolume, you can see them all, and interact with them. So you can easily chroot to as many different snapshots as you'd like.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.