What would be the fastest way to run unknown scripts and apps in *nix environments?

For example, to forbid writing and reading outside the working directory. Or to restrict access to hardware and most commands.

A virtual machine seems to be the most flexible. Adding a new restricted user is another option.

Are there better ways?


You can use namespaces to isolate the unknown process from the rest of the system; one tool which simplifies this, with a specific emphasis on security, is bubblewrap (which is used e.g. by Flatpak).

On Fedora-style systems, it’s as simple as

bwrap --ro-bind /usr /usr --symlink usr/lib64 /lib64 --proc /proc --dev /dev --unshare-pid bash

but you should read the documentation.

This approach is more secure than using restricted users, and lighter weight than using a VM. Whether that’s better depends on your exact requirements.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.