MXC - a sandboxed code execution system

(github.com)

18 points by nreece3 hours ago

3 comments

  • dannyw11 minutes ago
    This looks pretty decent actually. Sure, you could consider it a frontend&#x2F;SDK for bubblewrap&#x2F;seatbelt&#x2F;processcontainer; but setting em up consistently is far from trivial; and hand rolling is a really bad idea (speaking from experience).<p>I like the ‘learning’ mode for figuring out what perms&#x2F;config a runtime needs, the MIT license, the clear optional telemetry disclosures, and somewhat light and still readable documentation.<p>Regardless of your views on Microsoft, this looks quite useful; serves a clear purpose, and from a quick glance, looks like a high quality project even if it’s just the first version.
  • minraws23 minutes ago
    Why is everyone making their own code execution agent runtime engines I have an entire project built on top of openshell already, why not first come up with a sandboxing policy design, like unix did, and then build on top of that.<p>Currently all project do tend to agree on what and how they work but certain things being different makes porting tedius, if all of them have a bare minimum subset common amongst them it would be much easier to switch, and validate security surface area.<p>I feel like there are more vulnerabilities in this vibe coded slop sandboxes, and it&#x27;s more likely everyone one of us trusting them to build projects around them will shoot our foot off once a cve is hit in one that&#x27;s common in all of them but since they are all slop copies someone will have to figure out how they apply to all others and then manually fix it properly, and if one of them makes a CVE public it will leave dozens of these runtimes open to exploits.<p>I wish the best to my future self with regards to security I feel like we are completely screwed. Since we can no longer depend on upstream for security.
    • hobofan13 minutes ago
      Different use-cases have different requirements.<p>e.g. this one puts multi-platform support as a high requirement, a requirement that OpenShell doesn&#x27;t fulfil (and likely won&#x27;t given it&#x27;s architecture&#x2F;goals).
  • chneu1 hour ago
    Right you are, Ken!