Hacker GitHub

← All repos

google/nsjail

View on GitHub ↗ ★ 4,181 C++

A lightweight process isolation tool that utilizes Linux namespaces, cgroups, rlimits and seccomp-bpf syscall filters, leveraging the Kafel BPF language for enhanced security.

12 mentions on Hacker News by 9 people: 0 stories, 12 comments · first 2015-08-10 · latest 2025-09-17

Mentions per year 12 mentions · busiest year 2023 (3)
20082026
AllStoriesComments NewestTopOldest
  1. …use weechat inside nsjail on a raspberry pi (isolated rpi is enough here, but just for fun): https://github.com/google/nsjail/tree/master/configs
    comment by jagrsw · 2025-09-17 · in Irssi: IRC client in a Docker image
  2. https://github.com/google/nsjail
    comment by foretoldfeline · 2025-08-03 · in Writing a basic service for GNU Guix
  3. …[2] or flatpak's sandbox[3]? These could be also good benchmarks for the documentation. [1] https://github.com/google/nsjail [2] https://github.com/firecracker-microvm/firecracker-container... [3] https://docs.flatpak.org/en/latest/sandbox-…
    comment by fulafel · 2024-03-14 · in Identifying Software
  4. So what's the difference between nsjail[1] and bubblewrap[2]? [1] https://github.com/google/nsjail [2] https://github.com/containers/bubblewrap
    comment by bdahz · 2023-10-24 · in Server-side sandboxing: Containers and seccomp
  5. …by others), good job! Irrelevant nit: .proto files are protobuf definition files (like this one: https://github.com/google/nsjail/blob/master/config.proto ), a text representation of a specific protobuf contents is typically called (as per…
    comment by jagrsw · 2023-10-24 · in Server-side sandboxing: Containers and seccomp
  6. There is also https://github.com/google/nsjail
    comment by mrl5 · 2023-07-11 · in Firejail: Light, featureful and zero-dependency security sandbox for Linux
  7. Google's nsjail ( https://github.com/google/nsjail ) has a nice "inetd style" mode where it can launch a sandboxed process in response to a TCP connection for similar use cases to this (and is relatively quick to fire up).
    comment by mfincham · 2022-06-29 · in Notes on Running Containers with Bubblewrap
  8. FWIW, it's disabled in nsjail by default https://github.com/google/nsjail/blob/6483728e2490c1fc497a81... with relevant comment.
    comment by jagrsw · 2022-03-28 · in Bubblewrap: Unprivileged sandboxing tool for Linux
  9. …about this: https://news.ycombinator.com/item?id=13838596 (Link for convenience for others) https://github.com/google/nsjail
    comment by miduil · 2018-05-11 · in Linux sandboxing improvements in Firefox 60
  10. …hacks (I should work on that), though it offers some profiles for Apache-like type of applications: https://github.com/google/nsjail/tree/master/configs I believe nsjail uses one of the most advanced (if not the most advanced) seccomp-bpf…
    comment by jagger11 · 2017-10-15 · in Nsjail – A light-weight process isolation tool for Linux
  11. Here's your cool, lightweight and easily configurable sandbox - https://github.com/google/nsjail
    comment by jagger11 · 2017-04-12 · in Sandboxing Landscape
  12. …simple, it's made to wrap existing programs with a single command line invocation. Done and done. https://github.com/google/nsjail
    comment by dguido · 2015-08-10 · in Ask HN: Best Linux sandbox?