Comment by progval
13 hours ago
Successful sudo from a cgroup still makes you root on the machine. What you want for this is user namespaces, not (just) cgroups.
13 hours ago
Successful sudo from a cgroup still makes you root on the machine. What you want for this is user namespaces, not (just) cgroups.
yes, you would setup namespace and unshare it once mounted to isolate the sandbox so root only sees the sandbox / and not your /