Comment by WhyNotHugo
3 days ago
Quick Alpine container with the current directory mounted as the current directory:
docker run --rm -it -v $(pwd):/src -w /src alpine sh
Replace alpine with your favourite Linux distro or image.
Note entirely perfect, but will be enough against anyone not actively exploiting kernel privilege escalation bugs.
Neither podman nor docker will help you when the current directory is your home directory, though. It sounds like that's the root problem here- someone handed the keys to the kingdom to grok, and grok did what grok does, which is look at everything it can for context.
That's why I went with a different strategy and scope: Copy the current Git repo into a sandboxes dir, mount that copy in the container. The tradeoff is disk space allocated per sandbox, but I'm OK with that.
Wouldn't you solve the space allocation issue by using a symbolic link?
Sorry if it's a dumb question - I'm just getting into sandboxing for the first time myself and ran into this same thought before.
1 reply →