bubblewrap

Would you mind elaborating on what's wrong with flatpak? bubblewrap, used by flatpak for isolation, seems less readily escapable than firejail (https://github.com/containers/bubblewrap/blob/master/README....). (edit: changed link formatting)

There's no reason for a flatpak application to load slower than a 'native' application. It just namespacing[0] to separate the application Do you have measurements? Snap seems to be deeply flawed however. They use compressed files to store things that need to be mounted when one wants to run an application[1]. [0] https://github.com/containers/bubblewrap [1] https://www.freecodecamp.org/news/managing-ubuntu-snaps/

On Linux, you can do unshare --user --mount --map-root-user chroot /path/to/whatever and if you need to bind-mount some directories, you can do that before the chroot, e.g., $ unshare --user --mount --map-root-user # mount --bind /proc /path/to/whatver/proc # mount --bind /proc /path/to/whatver/sys # chroot /path/to/whatever without being root. (This requires a sysctl to be enabled for unprivileged user namespaces, which is on by default in the kernel.org tree and I think all major distro kernels have it on now. The feature has been in the upstream kernel since 2013.) If you want to do this at scale, a handy tool is bwrap(1) from https://github.com/containers/bubblewrap . (The README talks about how bwrap is a setuid program to prevent the need for that sysctl, but it also works great as a non-setuid program when tha

An alternative to unshare is also bubblewrap (https://github.com/containers/bubblewrap) which also sets up a new namespace. You can build up your own new filesystem by binding existing paths into the new root and then run a process within it: $ mkdir -p root/bin $ cp /bin/busybox root/bin/ $ bwrap --bind root / /bin/busybox sh BusyBox v1.27.2 (Ubuntu 1:1.27.2-2ubuntu3.3) built-in shell (ash) Enter 'help' for a list of built-in commands. / $ ls -l / total 0 drwxrwxr-x 2 1000 1000 60 Jul 22 11:07 bin

Flatpak handles all that too, all these tools are using the same Linux security primitives. There is really not any difference between them from a security perspective. Technically flatpak is based around bubblewrap for some of the low level bits, which is kind of like an even simpler version of firejail: https://github.com/containers/bubblewrap

Tell your manager you can't get work done up to industry standards. The high-level problem here is one of resource allocation and policy: you will have a similar technical problem in the future and you need to be confident that it's solvable, which requires management to be willing to resource solving it. You need either some other team's management to decide that this pace of development is something they will prioritize solving or your management to "go rogue" and get you set up on public cloud. But if you want a solution to this specific problem, the first suggestion I'd have is to install a non-root-requiring package manager like Linuxbrew or Nix (which is better if you can get a directory /nix writable by you, but workable even if not). Then you can install software without contacting the sysadmins and waiting. Alternatively, do you