Re: Landlock support landed into Emilua

Hello Vinícius,

On Mon, Dec 04, 2023 at 08:55:41AM -0300, Vinícius dos Santos Oliveira wrote:
> Emilua 0.5.0 was released with Landlock support:
> https://docs.emilua.org/api/0.5/changelog.html
> 
> Emilua is an execution engine with support for async IO for LuaJIT. It
> allows the creation of concurrent Lua programs. It also supports
> running separate Lua VMs for extracting parallelism.
> 
> Starting from the previous version, it added the ability to spawn Lua
> VMs in their own processes isolated in their own Linux namespaces for
> sandboxing purposes. However Linux namespaces are too convoluted and
> it became clear how inappropriate they really are to just create
> sandboxes.
> 
> Starting from the just newly released version, Landlock and Capsicum
> were added as alternatives to Linux namespaces.

This looks great, thanks for sharing!

I am not very proficient in Lua, but I a appreciate your well-written
introduction into sandboxing in your documentation (and also that you
are quoting Xkcd 1200 ;-))

Please do not hold back feedback if you run into any surprises or
questions!

–Günther