This is a really nice idea. The shebang-based approach makes it feel way more natural than wrapping everything in a separate command.
I like that it forces you to explicitly think about what a script actually needs (files, network, etc.). Most shell scripts run with way more access than they should.
Feels like a good middle ground between “no isolation” and heavier tools like bubblewrap or firejail.
1 comment
[ 2.6 ms ] story [ 8.7 ms ] threadI like that it forces you to explicitly think about what a script actually needs (files, network, etc.). Most shell scripts run with way more access than they should.
Feels like a good middle ground between “no isolation” and heavier tools like bubblewrap or firejail.