bubblewrap

iner to a unique user or group. [1] - https://ipset.netfilter.org/iptables-extensions.man.html [2] - https://github.com/netblue30/firejail [3] - https://github.com/containers/bubblewrap

ee future going towards with trusted platforms, where users on non-trusted system will be heavily handicapped, for example netflix not allowing 4k streaming, multiplayer games not allowing you online, or putting you on different servers etc... Valve's linux + proton push may make developers keep targeting the proton WIN32 subset in the future, but we'll see... Regarding modding, many online games do not allow it even in the current form, requiring you to play offline if the game is modified, or connect to a custom server. By the way, on linux you can easily achieve a sandbox using bwrap https://github.com/containers/bubblewrap

olution there (but so hard to administer as to be almost useless, though I do really like Fedora's default scopes and have used them successfully). [1] https://github.com/containers/bubblewrap

probably not sandboxing it correctly). Honestly, you should probably use something more robust than either of these programs if you're worried about malware. I just think it's easier and safer to use a VM and importantly I think you're less likely to shoot yourself in the foot using a VM (although it is still possible for malware to escape VMs depending on how they're configured). I'm not a security expert, take that advice with many grains of salt. ---- A lot of these programs (in my opinion) lack really good documentation about how to work with them. You kind of need to know the basics of how they work before you start. I think if anyone ever wanted to create a really detailed guide about what the different options are, what the considerations are, stuff like that, there's a lot of opportunity there to single-handedly drastically improve the accessibility of these tools. Most guides I have seen assume you know already know how the underlying permissions, process isolation, network stuff all works -- even some of the better guides on Arch (https://wiki.archlinux.org/title/Firejail, https://wiki.archlinux.org/title/bubblewrap) are just not accessible unless you're willing to go down those rabbit holes and figure out all of the terminology being used. It's not that the documentation doesn't exist, and once you understand how the command line options work they're kind of nice, but all of the documentation is kind of spread around and hard to find and there's a lot of pulling up manpages and looking up words that get dropped with no context -- if you happen to know Linux security even just reasonably well and you're ever looking around for an unmet need or niche that's possible for one person to solve on their own, then this is the kind of problem that could be fixed with like one in-depth blogpost series. There's just a real need for more tutorials about this stuff that can be shared with people who want to do manual configuration or command line usage, but that don't necessarily have the background required to just jump into the Arch docs. I've thought about trying to make one, but I am very nervous about giving people bad advice since I'm mostly self-taught on a lot of the security stuff. I haven't checked back though since I started using Bubblewrap, so also maybe I'm out of date and there's more documentation today.