Skip to content

Instantly share code, notes, and snippets.

@remram44
Created April 7, 2022 17:16
Show Gist options
  • Save remram44/fe30af580bfe1494931a392e95711207 to your computer and use it in GitHub Desktop.
Save remram44/fe30af580bfe1494931a392e95711207 to your computer and use it in GitHub Desktop.
jailing tool comparison from mstef

Readable version of https://ctrlc.hu/~stef/jails.txt

From this comment: https://news.ycombinator.com/item?id=30824936

function bwrap nsjail minijail
LoC 3K c 15K c, 4K c++ 12K c, 3K c++, 3K py, 1K rust
vendor redhat (not)google google
user ns default / disable with --share-user --disable_clone_newuser -U
ipc ns --unshare-ipc --disable_clone_newipc -l
pid ns --unshare-pid --disable_clone_newpid -p
net ns --unshare-net --disable_clone_newnet -e
uts ns --unshare-uts --disable_clone_newuts , --hostname --uts
vfs ns -v
cgroup ns --unshare-cgroup --disable_clone_newcgroup -N
seccomp --seccomp --seccomp_string, --seccomp_policy -s, -S, -L
cloned net --macvlan_iface
inherit caps --keep_caps
keep cap --cap -c
no new privs cfg:disable_no_new_privs -n
anonymous keyring -w
rlimit --rlimit_(as core cpu fsize nofile nproc stack) -R
cgroup settings --cgroup_mem_max, --cgroup_mem_mount, --cgroup_mem_parent, --cgroup_pids_max, --cgroup_pids_mount, --cgroup_pids_parent, --cgroup_net_cls_classid, --cgroup_net_cls_mount, --cgroup_net_cls_parent, --cgroup_cpu_ms_per_sec, --cgroup_cpu_mount, --cgroup_cpu_parent
personality(ADDR_COMPAT_LAYOUT) --persona_addr_compat_layout
personality(MMAP_PAGE_ZERO) --persona_mmap_page_zero
personality(READ_IMPLIES_EXEC) --persona_read_implies_exec
personality(ADDR_LIMIT_3GB) --persona_addr_limit_3gb
personality(ADDR_NO_RANDOMIZE) --persona_addr_no_randomize
chroot --chroot -C
pivot_root cfg:pivot_root_only -P
inetd-style --port, --bindhost
time limit --time_limit
max cpus --max_cpus
setuid --uid incompat with --share-user --user, --uid_mapping -u, -m,
setgid --gid incompat with --share-user --group, --gid_mapping -g -y -G -M --add-suppl-group
setenv --setenv --env
unsetenv --unsetenv
inherit env --keep_env
bind --bind / --ro-bind / --dev-bind --bindmount_ro, --bindmount -b, -k
--proc, --dev, --tmpfs, --mqueue --tmpfsmount, --mount, --disable_proc, --proc_rw --mount-dev, -r, -t
bind data --bind-data cfg:src_content
copy data --file cfg:is_bind:false
mkdir --dir
symlink --symlink --symlink
selinux --exec-label, --file-label
daemonize --daemon -i
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment