Hacker News new | ask | show | jobs
by mike_hearn 263 days ago
You don't need bind mounts, you can just pass access rights to directories into the sandbox directly. Also sandboxed apps run inside a (filesystem) container so file writes to $HOME are transparently redirected to a shadow home.
1 comments
xyzzy_plugh 263 days ago
Respectfully, it's not enough. You can't treat the inside of the sandbox as a generic macOS system. You can't really install arbitrary things or run arbitrary programs. The wheels fall off extremely quickly.
link
mike_hearn 262 days ago
That's true which is why I abandoned that approach, but the original comparison was against Bubblewrap which has the same issues (yes with enough overlays you can make a semi-writable system into which you can install things but you can tunnel brew outside the sandbox also).
link
xyzzy_plugh 262 days ago
Bubblewrap does not really have these issues at all. It's pretty much full containerization.
link