@jan This is a sign for useless sandbox driven by an uneducated developer: a list of kernel enforcement mechanisms that have been piled.
XFEDI
ActivityPubConversation
@jan For me personally most of my understanding of sandboxes derive from what Chromium team has ever done starting from https://lwn.net/Articles/332974/. This was before seccomp filters :-) Chromium is a great source of information for this topic.
LWN.netSeccomp and sandboxingBack in 2005, Andrea Arcangeli, mostly known for memory management work in those days, wandered [...]