alt Hacker NewsFor sandboxing: https://hackaday.com/2026/08/07/this-filesystem-is-born-to-f...
A process which is chrooted into failfs cannot open new files. It is limited to the set of filesystem file descriptors it already has open (presumably set up before the chroot or inherited into the process from some container runtime).
Replies
nesarkvechnep • today at 12:18 PM
They’ll do everything but adopt Capsicum. Shame.
judetechdevs • today at 8:24 AM
[dead]
So basically more fine tuned jail controls.
I'd love if chrooting would become easier. In particular a requirement to have bash or a specific shell is annoying; imo a simple REPL should suffice already there. I wrote one that works years ago, need to look into what is all needed for a chroot (I always used bash for this but I'd also want to change to my own shell eventually).