Hacker News new | ask | show | jobs
by BrightGlow 1724 days ago
Using fork and exec with a pipe is not going to work within a sandbox. That "cruft" is necessary for the thing to work...
1 comments

I get why they invented this for flatpak (Even though it still could be done with processes and namespaces), but my original point was wondering why they did not originally use fork, exec and pipe.
Because the goal was to make an API that works the same both inside the sandbox and outside the sandbox. Edit: It wouldn't work with just processes and namespaces because you need a way to talk to a resource with a privilege level above the current mount namespace.
Right, the child process can't escape the sandbox. I guess IPC here is the only sane choice.