开发者在Hacker News上发布了Drop项目，这是一个无需root权限的Linux沙箱工具1。该工具通过Linux命名空间（包括user、mount、network、PID、IPC和cgroup）实现隔离1，允许用户在独立的沙箱环境中安全运行第三方程序，防止恶意依赖对宿主系统造成完全破坏1。
Drop项目受到Python virtualenv的启发，但不同之处在于强制实施隔离而非依赖约定1。每个Drop环境都拥有独立的可写home目录，仅从原home目录选择性地挂载配置文件和目录，其中大多数为只读状态1。该工具支持gVisor用户空间内核选项，提供额外的保护层，防止利用宿主机内核漏洞逃出沙箱1。这是该项目的第三次提交，前两次未获得关注，此次发布新增了gVisor支持和项目网站1。
A developer has introduced Drop on Hacker News, a rootless Linux sandbox tool designed to safely execute third-party programs in isolated environments 1. The project leverages Linux namespaces—including user, mount, network, PID, IPC, and cgroup namespaces—to enforce strict isolation and prevent malicious dependencies from compromising the host system 1.
Drawing inspiration from Python's virtualenv model, Drop enforces isolation by default rather than relying on voluntary compliance 1. Each sandbox environment maintains its own writable home directory while mounting only selected configuration files and directories from the original home, with most mounted items set to read-only access 1. The tool further strengthens security through optional gVisor integration, which provides an additional protective layer against kernel exploit-based sandbox escapes by running a user-space kernel 1.
This marks the project's third submission to Hacker News, following two earlier attempts that garnered limited attention 1. The current iteration introduces gVisor support alongside a dedicated project website 1.
评论
还没有评论，欢迎留下第一条。