Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Could you elaborate on the differences? As far as I understood it firejail, or rather the Linux features that it depends upon, is far more powerful than FreeBSD jails.


From what I understand, firejail is a "syscall filter". This moves it to the same category as capsicum (https://www.freebsd.org/cgi/man.cgi?capsicum), but without Capsicum's security model, instead implementing something ad-hoc, probably by using Linux' seccmp.

Jails, on the other hand, are not a sandboxing mechanism - they are system-level virtualization, like Linux namespaces, but with a simpler interface. You can use it for sandboxing, but it's not what the mechanism fundamentally is.


Firejail does more than just syscall filtering.


Please tell more.



Looks like a GUI wrapper around jails, with some seccmp hacks to work around deficiencies in namespaces.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: