11 comments

[ 3.0 ms ] story [ 39.0 ms ] thread
Isn't restricting chromium to only ~/Downloads already possible in a regular Linux OS by running chromium inside a chroot?
Perhaps, though with a fair amount of hassle giving it access to device files, shared libraries, dynamically loaded plugins, and so on.
You'd use a portable build.
Not really, since ~/Downloads isn't inside a chroot. You accomplish it most easily with AppArmor.

Anyway, OP is telling you how to do it with OpenBSD, which is also a "regular" OS.

(comment deleted)
What is the advantages of this over running a snap contained browser?
Could I do this with Docker on Windows?
There's no fundamental reason you can't since there are X11 clients for windows, which is what this uses. However, FreeBSD jails and Linux containers have very little overhead on their native OS, whereas Docker on Windows runs a Linux VM, so the experience might not be that great. Only way to know though is to try it!
I use Sandboxie plus on Windows, easy to set-up, found no faults yet