Sandboxing with minimal effort
Inko, a programming language, recently introduced a feature to sandbox applications with minimal effort. Memory safety is a goal for Inko, but developers often make mistakes, even when using LLMs for coding. One popular method for improving security is containerization, like running shost, a static file server written in Inko, using Podman.
This allows for restricting capabilities and mounting specific files as read-only volumes. However, applying these restrictions to the application itself would be even better. Many operating systems offer ways to sandbox applications, including Landlock for Linux, Seatbelt for macOS, Capsicum for FreeBSD, and pledge/unveil for OpenBSD.
Inko's new API uses these primitives to provide a cross-platform sandboxing solution, handling platform-specific differences. While Capsicum requires changes to the program structure on FreeBSD, it's simpler on Linux and macOS. The API allows for easy sandboxing of an Inko application, such as shost, with minimal code. This ease of use is crucial for security features, as the value lies in how accessible they are, not just what they can achieve.
Written by urgent.news from Lobsters's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
