I'm evaluating running Chromium without native sandboxing in a rootless container. A few points:
- You can containerize Chrome using rootless containers with something like
podman. This will utilize kernel user-namespaces to isolate the Chrome process.
- Chrome also contains a sandbox mode which is enabled by default.
- User-namespaces make processes think they're root, while running in kernel namespace-isolation.
- Chrome, running as root, requires you to use the
--no-sandboxflag which is required in rootless container.
To what degree, if any does
--no-sandbox make Chrome less secure, when compared to a rootless container?