Sandboxing / Jailing Haiku applications / services

[kallisti5]

I was thinking bit on ​https://discuss.haiku-os.org/t/showcase-mariadb/16456 , and we really should look into some kind of simple, standardized way to sandbox / jail applications.

We already do this today somewhat with haikuporter via the chroots.

Thoughts:

• Mounting essential packages (haiku, etc) read only in a chroot at a standardized location
• Control various permissions reaching outside of this chroot in a simplistic user-friendly way (network, hardware, etc)
• Adding support to launchd for sandboxing long-running services
• Adding tools to run applications in a sandbox and specifying the dependent OS packages.

We're desktop focused with everything running as uid 0. Instead of relying on non-root / non-administrative users for permission sandboxing of applications, lets do it the more modern way and make a framework around it.

tl;dr.. haiku "containers" without the complexities of oci, docker, multiple distros, etc.

"Haiku Jails" if you're a BSD person :-)

This all starts by simplifying the chroot process with official os provided tools, and adjusting Haikuports to use them instead of doing everything itself.

[kallisti5]

To be clear, i'm not proposing containers on Haiku. Someday (tm) we can add podman and podman-machine (running a Linux VM for container development)

This is more of a native "BSD-like Jails" path

[kallisti5]

• ​https://github.com/haikuports/haikuporter/blob/49672cffc9e0f7d440ef05d68584d94a831ed581/HaikuPorter/Port.py#L769

A bit more information on how haikuporter does it. (The logic is pretty spread out in the Haikuporter code)