OS Native Sandboxing vs Container Solution

[yveszoundi]

As I'm in the middle of implementing foundational support that will enable easier Flatpak packaging, there are couple of things to reconsider.

• Is a container solution absolutely required with everything that comes along with it?
• Wouldn't it be much better if native OS capabilities could be leveraged instead? How difficult is it to get it reasonably right?

Issues with a container solution

• Additional software installation for the user

  • Issues with 3rd party software outside of my control
  • Issues related to specific operating systems or specific versions of the container solution
  • Disk space management that users might not be aware of in the long run (older container images to remove)

• Higher computing resources footprint

  • Memory usage
  • There's the memory required by the application itself, plus the memory required by the container solution
  • If the default/custom memory settings of the container solution are too low the application will terminate abruptly...
  • Slower processing due to indirection/translation layers

• Lack of service management

  • entrusted doesn't attempt to start/stop or configure services running on the user's machine
  • For some people this is fine, for non tech-savvy users it might not be "understandable/acceptable"
  • If those services fail (i.e. Docker) for whatever reason (i.e. on Windows Hyper-V and VirtualBox conflicts or something among those lines), it can be frustrating for non-tech savvy users

Pros of a container solution

• Temporary files get automatically cleaned up inside the container
• There's some layer of isolation with the main system
• Things are technically simpler to manage and streamline from a software implementation perspective
  • There's not too much operating system specific code to consider
  • There's no need for a strong understanding of everything operating system specific sandbox approach
  • on Apple software there's no proper sandbox API, sandbox-exec is "deprecated" without any clear flexible/good alternative)
  • on Windows, a correct software implementation might not be trivial. I also barely use Windows, there's been years where I didn't use a Windows machine at all
  • on Linux, Apparmor and Seccomp profiles is reasonably straightforward, but what if users have SELinux enabled instead of AppArmor???

[yveszoundi]

General "challenges" (time consuming activities) include:

• OS native sandboxing integration
  • seccomp on Linux
  • AppContainer on windows
  • App Sandbox for Apple
• Tesseract bundling for OCR, ideally statically linked
• Cross-platform file conversions, more specifically replacing poppler code for PDF pages extraction into images.
• "Rigorous" testing with known malware...