<story><title>Server-side sandboxing: Containers and seccomp</title><url>https://www.figma.com/blog/server-side-sandboxing-containers-and-seccomp/#j1WRe</url></story><parent_chain></parent_chain><comment><author>rubenfiszel</author><text>If you are looking to self-host a scalable backend that runs arbitrary code in python&amp;#x2F;typescript&amp;#x2F;bash&amp;#x2F;go with optional sandboxing using nsjail like figma, nsjail is  what we use as isolation layer at &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;windmill.dev&quot;&gt;https:&amp;#x2F;&amp;#x2F;windmill.dev&lt;/a&gt; (Open-source alternative to Retool&amp;#x2F;Airplane)&lt;p&gt;(Our python nsjail config for instance: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;windmill-labs&amp;#x2F;windmill&amp;#x2F;blob&amp;#x2F;main&amp;#x2F;backend&amp;#x2F;windmill-worker&amp;#x2F;nsjail&amp;#x2F;run.python3.config.proto&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;windmill-labs&amp;#x2F;windmill&amp;#x2F;blob&amp;#x2F;main&amp;#x2F;backend&amp;#x2F;...&lt;/a&gt;)</text></comment>
<story><title>Server-side sandboxing: Containers and seccomp</title><url>https://www.figma.com/blog/server-side-sandboxing-containers-and-seccomp/#j1WRe</url></story><parent_chain></parent_chain><comment><author>imiric</author><text>I haven&amp;#x27;t used seccomp, but have recently been playing around with the Linux pledge port[1]. It has a very friendly UI, but I still struggled with allowing some complex apps to run at all, because of the sheer amount of syscalls and devices they required. Digging through a mountain of strace output is tedious...&lt;p&gt;Can someone with experience with both comment on how (the Linux port of) pledge compares to seccomp? Can it be considered a replacement at this point?&lt;p&gt;It seems like it could handle the last scenario described in the article fine, since it allows setting granular rwcx permissions on individual paths.&lt;p&gt;[1]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;justine.lol&amp;#x2F;pledge&amp;#x2F;&quot; rel=&quot;nofollow noreferrer&quot;&gt;https:&amp;#x2F;&amp;#x2F;justine.lol&amp;#x2F;pledge&amp;#x2F;&lt;/a&gt;</text></comment>