The Art of Userspace Sandboxing on Linux

A whirlwind tour of building userspace sandboxes on Linux using various primitives provided by the Linux kernel like namespaces, seccomp, capabilities, landlock, userspace networking. We will go through how to combine these primitives to create sandboxes which have defense in depth against various attacks. We will understand how modern rootless container engines and sandboxes make use of these primitives.

Code: https://gist.github.com/rrampage/92f0eb6bf56d7bb403aff069cc8f1d6b

• Linux has powerful primitives which allow unprivileged users to run code in an isolated environment.

• This talk aims to help understand the limitations and risks of each primitive and how to layer them securely.

• Understanding the benefits and drawbacks of shared kernel isolation using userspace-only primitives