Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Same question. One thing I really dislike in Bubblewrap is that I must share the whole net user namespace even if all I want to do is use UNIX domain sockets.

Since I only see net options specifying ports, does this handle this use case?



> if all I want to do is use UNIX domain sockets

I routinely --unshare-net with UDS ro-binds.

You may be using abstract sockets (@/path/uds.sock) and those do require the same netns I think.


Landlock supports scoped abstract UNIX socket: https://docs.kernel.org/userspace-api/landlock.html#ipc-scop...

Landlock doesn't use namespaces, they are orthogonal.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: