logoalt Hacker News

spijdaryesterday at 11:18 PM0 repliesview on HN

Yes, Chromium has "native" sandboxing on all those platforms, Windows [0] Linux [1] and MacOS [2].

Chromium uses both seccomp filtering as well as user namespaces (the technology that Docker/Podman use).

The Windows and MacOS sandboxing strategies are more "interesting" because I've seen very few (open source) programs that use those APIs as extensively as Chromium. On Windows, it makes use of AppContainer [3] (among other things), while on MacOS it uses the sparsely documented sandbox API [4], which I think was based on code from TrustedBSD?

[0] https://chromium.googlesource.com/chromium/src/+/HEAD/docs/d...

[1] https://chromium.googlesource.com/chromium/src/+/HEAD/sandbo...

[2] https://www.chromium.org/developers/design-documents/sandbox...

[3] https://learn.microsoft.com/en-us/windows/win32/secauthz/app...

[4] https://manp.gs/mac/7/sandbox