David Michael wrote:
> - Firecracker can be built with Fedora's libc (glibc), but it is
> officially unsupported upstream[3]. Functionality would be harmed by
> not using musl, e.g. seccomp filters are not used.
Upstream's refusal to write seccomp filters that work with glibc should be a
red flag. It is definitely possible to sandbox glibc applications with
seccomp, e.g., Chromium does it. It does need updates/fixes to the seccomp
rules with almost every new version of glibc, but it is possible.
Kevin Kofler
_______________________________________________
devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
