alt Hacker NewsThis will make it much easier to trap people into installing it without any isolation just to their primary user account or even make it run with admin privileges by default.
With the recent security related events we already see that it seems to be wide spread practice that many operators avoid the hassle of isolating their agents.
It is just an incredible cultural experience to see how quick stupidity gets accepted as a behavioural default.
Replies
usef- • today at 8:16 AM
The Linux version seems to use bubblewrap + seccomp for a "workspace sandbox" automatically, in addition to the auto mode and/or user approval.
A VM would be even better, but people could presumably run this in one if we manage to convince them of higher sandboxing in general ?
➕ show 2 replies
At least on Windows/Mac, a significant number of users of this app are non developers, and you should tame your expectations about them handling things like "isolation".
Even for developers working on Linux, you'll be surprised how many have never run a docker command in their life.