sysbox VS firejail

You are probably referring to Sysbox (https://github.com/nestybox/sysbox), which I believe will meet your requirements (systemd, inner containers, security, etc).

Btw, Sysbox is already supported in Docker-Desktop (business tier only), so you can easily do what you want with this instruction:

$ docker run -it --rm -e SYSBOX_SYSCONT_MODE=TRUE nestybox/ubuntu-focal-systemd-docker:latest bash

Disclaimer: I'm Sysbox's co-creator and currently working for Docker.

One project in this space that looked quite promising to me is sysbox[0]. I've used them once for a gitlab runner set-up similar to what is described in their blog[1].

It's currently working great and I have not had any major crashes/incidents for at least the past 8 months.

[0]: https://github.com/nestybox/sysbox

[1]: https://blog.nestybox.com/2020/10/21/gitlab-dind.html

Today, things are very different. Docker-in-Docker has a more secure and safe approach with rootless containers and freemium tools like sysbox. Tools like sysbox let you run Docker-in-Docker without the -privileged flag and optimizes specific scenarios, like running multiple nodes of a Kubernetes cluster as ordinary containers.

Right now I am going with sysbox rootless containers. https://github.com/nestybox/sysbox

We’ve been using Sysbox (https://github.com/nestybox/sysbox) for our Buildkite based CI/CD setup, allows docker-in-docker without privileged containers. Paired with careful IAM/STS design we’ve ended up with isolated job containers with their own IAM roles limited to least-privilege.

This is what I would do instead. Install Sysbox in your host (assuming Linux) and launch a system-container inside of which all your app containers will live, including a dedicated docker engine and portainer itself. By doing this you are isolating your host, while at the same time, you are achieving your goal of encapsulating your entire stack in a single docker image, which you can now take with you anywhere and re-instantiate by doing a simple docker run.

See http://jpetazzo.github.io/2015/09/03/do-not-use-docker-in-docker-for-ci/ and https://github.com/nestybox/sysbox

Maybe sysbox can do what you want.

He updated it last year to add: >Update (July 2020) : when I wrote this blog post in 2015, the only way to run Docker-in-Docker was to use the -privileged flag in Docker. Today, the landscape is very different. Container security and sandboxing advanced very significantly, with e.g. rootless containers and tools like sysbox. The latter lets you run Docker-in-Docker without the -privileged flag, and even comes with optimizations for some specific scenarios, like running multiple nodes of a Kubernetes cluster as ordinary containers. This article has been updated to reflect that!

bubblewrap is designed as a low-level too. There is nothing quick and dirty about it. It disallows everything by default and you have to be explicit about what you want to share with the host. If your application needs complex permissions/resources, then you will need to have a complex bubblewrap command line.

Once you have figured out which permissions/resources you need for a given program, you can wrap the command line invocation in a shell script.

If you want other people to do the work of defining permissions/resources, then have a look at firejail: https://github.com/netblue30/firejail

Firejail is cool: https://github.com/netblue30/firejail

Linux namespaces/cgroups but nowhere near as heavy as Docker.

I use it when I want to limit the memory of a Python script:

```

Firejail can also be a useful option, though no good if you're on Mac https://firejail.wordpress.com/

Uses the same Linux primitives as docker etc, but can be a bit more ergonomic for this use case

Wonderful little tool, too bad you must chain various exec calling tools to get cgroups (a bit akin to `ionice ... nice ... cmd`) and Linux users namespaces can't allow UNIX sockets while preventing network access (I think?).

Migrated from Firejail when its complexity annoyed me too much and I hit https://github.com/netblue30/firejail/issues/3001 (Firejail doesn't like parens or brackets in --put/--get parameters) to a badly NIH version using bwrap and bash to have "profiles":

Firejail, Flatpak (which uses Bubblewrap under the hood), and Snap (which uses AppArmor) all use the same underlying technology: Linux namespaces.

This question comes up a lot, and has been answered here: https://github.com/netblue30/firejail/wiki/Frequently-Asked-...

TL;DR: Firejail has much more comprehensive features than Flatpak (Bubblewrap). Firejail also has more comprehensive network support, support for AppArmor and SELinux, and easier seccomp filtering.

Compared to Snap (which uses AppArmor), Firejail is compatible with AppArmor and again goes above and beyond with a lot of additional features.

Firejail does this. The profile database is the two "profile" directories in https://github.com/netblue30/firejail/tree/master/etc

What do you mean by a Firefox container? Do you mean FireJail?

Apps in ChromeOS are sandboxed regardless. Over at Linux we're trying to achieve 'bandaid-solutions' using tools like bubblewrap and (albeit to a lesser degree) firejail. Note that the term 'bandaid-solutions' was not meant derogatory, I think both bubblewrap and firejail are amazing utilities. However, their best efforts can only do so much in an environment in which privileged access is the norm, rather than the exception. So to be more elaborate, apps on Linux (by default) can basically do whatever they want. By contrast, ChromeOS has been built from the ground up (as previously mentioned) to sandbox apps regardless.

The simpler one is to take a look at firejail