AI, Data Science & Cloud Certificates from Google, IBM & Meta
Launch Your Cybersecurity Career in 6 Months
Overview
Google, IBM & Meta Certificates – 40% Off
One Coursera Plus subscription covers most Professional Certificates on Coursera.
Unlock All Certificates
A practical introduction to building a Linux application sandbox with system APIs. It covers namespaces, filesystem isolation, and seccomp filters, with examples that explain mechanisms also used by projects such as Chromium and Docker.
Syllabus
Intro
Who am I
Disclaimer
What is a Sandbox
Why use a Sandbox
Application expectations
Setting up a sandbox
Example application
namespaces
usernamespace
mappings
running as root
making a new file system
making a new mount point
making a temporary file system
proc file system
new proc namespace
pid namespace
Create new namespace
Clone newnet
Build the application
Protect the system
Seccomp
Seccomp Program
libsec comp
argument checks
compare strings
Taught by
NDC Conferences