(untitled)

Anyone knows a better way to isolate apps without using resource intensive VMs? VMs take a lot of memory space and storage space especially if you wish to isolate 1 App per VM, which you sometimes need to do. I know things like whonix and qubes exist, but I don't want to daily drive them, and I just want a basic separation layer that doesn't eat resources.

>>87835 Containers have been around since forever. Docker has been out for over a decade now. It's what they are for.

>>87837 Possible to bind a proxy with each process smoothly using Docker?

>>87838 https://stackoverflow.com/questions/70971310/how-to-make-docker-container-connect-everything-through-proxy

Docker or kubernetes, as above lainon said, containerization is key.

Docker, Podman, and if you're feeling frisky you can use Freebsd with Jails. Also if you're using a systemd-based linux operating system you could try systemd's nspawn utility, but it's a less popular (read: less documented) solution than the other ones. Pretty nifty though.

You can use Apparmor + Firejail. simple and straightforward.

>>87835 For my torbrowser chroot on my gentoo machine without dbus etc. use debootstrap to make a chroot container and the following to execute from outside the chroot: alias torbrowser-launcher=' \ sudo mount --bind /dev ${HOME}/Jail/dev && \ sudo mount --bind /dev/pts ${HOME}/Jail/dev/pts && \ sudo mount --bind /proc ${HOME}/Jail/proc && \ sudo mount --bind /sys ${HOME}/Jail/sys && \ sudo mount --bind /run ${HOME}/Jail/run && \ sudo -E chroot ${HOME}/Jail /bin/su amnesia -c "apulse torbrowser-launcher"' Not sure if would suggest it or not, it's probably a bit of a dated approach.

>>87874 >compound command as alias >sudo >sudo fuarrrking mount what's even the fuarrrking point dude. man schroot at least.

>>87874 Yeah, use bubblewrap to do all that kind of user namespace isolation + bind mounting.