Hacker News new | ask | show | jobs
by Cloudef 1727 days ago
I get why they invented this for flatpak (Even though it still could be done with processes and namespaces), but my original point was wondering why they did not originally use fork, exec and pipe.
1 comments

Because the goal was to make an API that works the same both inside the sandbox and outside the sandbox. Edit: It wouldn't work with just processes and namespaces because you need a way to talk to a resource with a privilege level above the current mount namespace.
Right, the child process can't escape the sandbox. I guess IPC here is the only sane choice.