apparmor.d VS resolve

If anyone want to look further into sandboxing applications on Linux, you can also look at AppArmor and the sandboxing features built into systemd.

I love this repository for bases for AppArmor profiles[1], really good work. Never found a repository as good for systemd, but there are a few around.

[1] https://github.com/roddhjav/apparmor.d

Then, categorize all your script zoo: maybe some script group want to only read the data, while some need to write, maybe one group needs to use certain set of binaries, and other group - others.

You could utilize some profiles from apparmor.d repo, but you should be slightly aware how it works (disclaimer: I'm the contributor).

Regardless, I wrote an AppArmor profile so it couldn't happen again.

Maintainer's response.

There is a project in early development: apparmor.d. Adopting some or all profiles will do the job. To use it smoothly, basic AppArmor knowledge is required. (I'm the contributor)

Dependent on the OS and Firefox distribution. I can advertise profile that I co-maintain. It uses non-standard tunables, which will require some README reading to get them into the system.

Red Hat based distros come preconfigured with a lot of SELinux policies. With AppArmor, you get basically nothing. There is a project I also contribute to from time to time, that gives you a lot more policies, but this is entirely out-of-tree (https://github.com/roddhjav/apparmor.d).

Hi, I'm new to using podman but have been attempting to run DaVinci Resolve in a container as outlined here: https://github.com/fat-tire/resolve

Hello, I m noob on OpenSuse and Microos. I like very much it. I would like to install Davinci resolve in a container and use podman for lunch it. I would like to use: https://github.com/fat-tire/resolve . Someone already test it? I wouldn't use Nvidia driver on my microos but I would like to use it in a container? Is it possible?

Running GUI applications in containers isn't easy, there are tools that set it up for you like distrobox, but you lose out on most of the sandboxing that way. A much simpler way to isolate GUI apps is Flatpak (or snap). Discord is available on Flathub, but I couldn't find any alternative packages for Resolve. There is, however, this repo that has the containerfile to wrap the Studio version, which isn't as simple as a Flatpak, but it's a whole lot easier than figuring out the container for yourself.

Only for lack of hardware to test it on. There is an open issue if you want to try your hand at getting it to work on non-NVidia, though it will run best on some kind of dedicated GPU due to the heavy graphics operations it does.

See https://github.com/fat-tire/resolve/issues/8

FWIW, you might want to try running Resolve out of a container (Docker / Podman) : https://github.com/fat-tire/resolve

Let me also point you in the direction of https://github.com/fat-tire/resolve