carlgleisner
FreeBSD Capsicum for sandboxing ports
Hi all,
I came across this lovely lightning talk about sandboxing using, among other things, Capsicum on FreeBSD:
It was posted on the Erlang forums as well:
In the lightning talk, Krasen talks about NIF:s and C nodes for interoperability and combining that with sandboxing techniques. I’m using ports for processing Word documents – i.e. unzipping and XML parsing – and figure that should be possible to sandbox in a similar manner.
If anyone would be interested in sharing any experience or resources doing this I would be most grateful 
Trending in Questions
Other Trending Topics
Latest on Elixir Forum
Sponsor Spotlight
Enabling companies to succeed by building software people love.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #channels
- #elixirconf
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixir-ls
- #phoenix_html
- #iex
- #blog-post
- #graphql
- #genstage
- #ai
- #elixirconf-us
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #metaprogramming
- #hex
- #performance
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Practical resources that improve the lives of professional developers.
Producing high quality Elixir screencasts since 2017.
The deployment platform built for Elixir: PaaS ease, VPS control.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
First 2 of 2 Posts
krasenyp
I don’t know why I’m seeing this now. I’ll make sure to develop an example project for the approach I present in the video.
drobban
I have done something similar in Freebsd with Jails.
Where I wanted an environment completely locked down for evaluating code from “external” sources. Im using ports and the only data allowed to flow back and forth is a stream of text.
The environment running the code is completely locked down, minimal user privileges in a readonly setup.
Heard of capsicum previously, but never explored it. So I will definitely have a look at it =) so thank you for the link