‹ BackHN Continuity

Thread

Show HN: Drop – A rootless Linux sandbox with gVisor support

193 points · 63 comments · mixedbit

  1. p2004a · · focus · HN ↗
    Thank you for building it! I started using Drop a few weeks ago, and I've been very happy with it so far (thanks again for quickly fixing a few issues I've reported :)!).

    For me, it nails the convenience vs isolation aspect quite well, and I would like to get to a point where I can use it for all my development by default.

    The main challenges that I still have, which none of the solutions I've found so far resolve, are:

    - development of containerized applications, where e.g., docker/podman compose is used to bring up services

    - development of GUI applications with hardware acceleration, like games (maybe security contexts for pipewire and wayland, like what's done in flatpak would be a good path?)

    When I did my research in this space last time, <a href="https:&#x2F;&#x2F;litterbox.work&#x2F;" rel="nofollow">https:&#x2F;&#x2F;litterbox.work&#x2F; was another option I&#x27;ve considered, and it is very nice too, but the friction is a bit higher than drop: it&#x27;s slower to rebuild envs, lacks a &quot;base&quot; config, etc. Drop was much easier to adopt for me so far.

    1. mixedbit · · focus · HN ↗
      Thanks! I have GUI applications sandboxing on the roadmap. I also ponder the idea to add VM as the third runtime option (in addition to currently supported native Linux namespaces and gVisor). I&#x27;m not yet sure if this is feasible, but VM could allow to start containerized apps within the sandbox as it dodges the nested namespaces problems with containers.
    2. binsquare · · focus · HN ↗
      hey there, smolvm might be the right tool for your needs of containerization + GUI with gpu acceleration through vulkan.
Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.