Skip to content
Snippets Groups Projects
  • Simon McVittie's avatar
    1e7e83c9
    pressure-vessel: Add experimental code path for Flatpak sub-sandboxing · 1e7e83c9
    Simon McVittie authored
    
    This is experimental and subject to change. It requires branches of
    Flatpak that have not yet been reviewed or merged, so it's guarded
    by (deliberately undocumented) environment variables by default.
    Only enable this if you are a pressure-vessel developer and know
    precisely what you're doing.
    
    This feature also requires a non-setuid bwrap executable, and a kernel
    that allows the non-setuid bwrap to create new user namespaces.
    Fedora, Ubuntu, Debian >= 11, and Arch Linux's default kernel are
    examples of systems that should be OK; Debian <= 10, SteamOS 2, and
    Arch Linux's linux-hardened are not.
    
    I'm landing this despite its experimental status because leaving it in
    a branch means we have to rebase it all the time, which just slows
    us down.
    
    Signed-off-by: default avatarSimon McVittie <smcv@collabora.com>
    1e7e83c9
    History
    pressure-vessel: Add experimental code path for Flatpak sub-sandboxing
    Simon McVittie authored
    
    This is experimental and subject to change. It requires branches of
    Flatpak that have not yet been reviewed or merged, so it's guarded
    by (deliberately undocumented) environment variables by default.
    Only enable this if you are a pressure-vessel developer and know
    precisely what you're doing.
    
    This feature also requires a non-setuid bwrap executable, and a kernel
    that allows the non-setuid bwrap to create new user namespaces.
    Fedora, Ubuntu, Debian >= 11, and Arch Linux's default kernel are
    examples of systems that should be OK; Debian <= 10, SteamOS 2, and
    Arch Linux's linux-hardened are not.
    
    I'm landing this despite its experimental status because leaving it in
    a branch means we have to rebase it all the time, which just slows
    us down.
    
    Signed-off-by: default avatarSimon McVittie <smcv@collabora.com>