runc VS Firejail

It's interesting that, in light of things like this, you still see large software companies adding support for new components written in non-memory safe languages (e.g. C) As an example Red Hat OpenShift added support for crun(https://github.com/containers/crun), which is written in C as an alternative to runc, which is written in Go( - Source: Hacker News / 8 months ago

Yeah, runtimeClass lets you specify which CRI plugin you want based on what you have available. Here's an example from the containerd documentation - you could have one node that can run containers under standard runc, gvisor, kata containers, or WASM. Without runtimeClass, you'd need either some form of custom solution or four differently configured nodes to run those different runtimes. That's how krustlet did... Source: over 1 year ago

Your Docker Container can only run Linux. That's because Docker takes advantage of runC which uses the Linux kernel. You can't run Windows inside of Docker. But of course you can run Docker on a Windows host machine. If you are running a .NET project, you won't be able to use Docker. On the other hand, if you're running .NET Core then you're in luck! - Source: dev.to / over 1 year ago

This is what Podman, an open-source daemonless and rootless container engine, was developed with in mind. Podman runs using the runC container runtime process, directly on the Linux kernel, and launches containers and pods as child processes. In addition, it was developed for the Docker developer, with most commands and syntax seamlessly mirroring Docker's. Buildah, an image builder, and Skopeo, the image utility... - Source: dev.to / almost 2 years ago

If you are curious about how exactly Docker does this I urge to have a look at the following links on layered file system and the library runc and also this great wikipedia overview of Docker. - Source: dev.to / almost 2 years ago

Firejail can also be a useful option, though no good if you're on Mac https://firejail.wordpress.com/ Uses the same Linux primitives as docker etc, but can be a bit more ergonomic for this use case. - Source: Hacker News / 8 months ago

You can find more info on its world-press website: https://firejail.wordpress.com/. Source: about 1 year ago

Try running your Wine app through something like Firejail. Source: about 1 year ago

Firejail is a program that helps to improve the security of your system by creating a restricted environment for running non-trusted applications. It does this using Linux namespaces, seccomp-bpf, and Linux capabilities, and is easy to use thanks to its setuid sandbox feature. Source: over 1 year ago

Sorry, missed "avoid having libs on local machie". Someone mentioned chroot. That's good! Also maybe firejail. I also use x11-docker. Source: over 1 year ago