Status

[drahnr]

The repo seems rather unmaintained and a couple of security related issues are not addressed for years.

Is this still intended to be used eventually or does it have a successor?

[jdm]

Nobody is actively maintaining it.

[zaddach]

Do you still accept pull requests?

[jdm]

I suspect it will be more effective to fork. I don't think anybody involved with Servo these days has any real experience in this code, so reviewing any changes would be challenging.

[lonnietc]

Hello, I was looking for a cross-platform (Linux, Windows, and MacOS) sandboxing application to isolate some service/daemon with control to the network and filesystem. Came across this project but it seems not to be active now.

I am actually now wondering if perhaps something like Docker containers would be better since they now have and engine that runs on Windows, Linux, and MacOS but it is not strictly a sandbox but might work all the same.

Thanks

[wolfv]

We recently started to use birdcage and are pretty motivated to implement windows support for it, too. Would be happy to collaborate if you're interested.

[zaddach]

I'd be happy to collaborate. I have a half-finished POC impl of a gaol sandbox for Windows.

[wolfv]

Wow, that's exciting! Do you want to chat about it sometime @zaddach? You can find my email on my Github profile. We have a pretty clear plan how to go about the Windows sandbox, but haven't found the time yet.

[chrisduerr]

Birdcage author here: I've recently started polishing up my browser to support Servo as an engine and noticed that sandboxing is disabled by default.

I'd be curious what kind of issues there might be with gaol that prevent Servo from sandboxing by default. For a browser it seems like a pretty fundamental security risk to not sandbox its processes/threads.

On Linux, the easiest solution might just be relying on bwrap instead, since most sandboxes require spawning a separate process anyway.