Sydbox: A highly paranoid, innovative sandbox for Linux (froscon2026)

Sydbox is a sandbox, designed to contain and isolate processes from each other - similar to Bubblewrap, Firejail, GVisor, and minijail. By being very paranoid and leveraging as many of the tools that the linux kernel gives us it manages to do some surprising things. This talk wants to show some of the design decisions, some of the more...