I'm evaluating running Chromium without native sandboxing in a rootless container. A few points:

  • You can containerize Chrome using rootless containers with something like podman. This will utilize kernel user-namespaces to isolate the Chrome process.
  • Chrome also contains a sandbox mode which is enabled by default.
  • User-namespaces make processes think they're root, while running in kernel namespace-isolation.
  • Chrome, running as root, requires you to use the --no-sandbox flag which is required in rootless container.

To what degree, if any does --no-sandbox make Chrome less secure, when compared to a rootless container?


You must log in to answer this question.

Browse other questions tagged .