minijail

New project: Chromebook from scratch The Google userland programs are removed but the kernel and drivers are retained. This frees up lots of storage space to be filled with the owner's choice of open source userland programs.^1 Read-only filesystem, "powerwashing" system recovery, open source bootloader. Chromebook without the Chrome. Not for commercial use but for recreation and experimentation. For commercial/educational use people can use a Chromebook from Google. I have heard that some people own more than one computer. What some (not all) computer users want is an inexpensive portable computer that has excellent hardware support in the Linux kernel. These users users are capable of administering their own computer and have no inclination to let a so-called "tech" company remotely install software on their computer at any time ("

https://gvisor.dev/docs/architecture_guide/platforms/ : > gVisor requires a platform to implement interception of syscalls, basic context switching, and memory mapping functionality. Internally, gVisor uses an abstraction sensibly called Platform. Chrome sandbox: https://chromium.googlesource.com/chromium/src/+/refs/heads/... Firefox sandbox: https://wiki.mozilla.org/Security/Sandbox Chromium sandbox types summary: https://github.com/chromium/chromium/blob/main/docs/linux/sa... Minijail: https://github.com/google/minijail : > Minijail is a sandboxing and containment tool used in ChromeOS and Android. It provides an executable that can be used to launch and sandbox other programs, and a library that can be used by code to sandbox itself. Chrome vulnerability reward amounts: https://bughunters.google.com/about/rules/5745167867576320/c... Sy