Simplify sandbox APIs for easier process isolation
Problem
Users seek simpler, more fine‑grained sandboxing mechanisms to avoid complex configurations and implementations, particularly when isolating untrusted code requires quick and reliable isolation.
Pain points
- Lack of a simple pledge/unveil‑style system call API
- Existing sandbox mechanisms (e.g., seccomp, Capsicum) are complex to configure and adopt
- Need for fine‑grained capability granting instead of a default‑deny security model
Questions to verify
- Would you be willing to adopt a pledge/unveil‑style simple API for sandboxing?
- Does the current toolchain lack a lightweight sandbox solution that meets security requirements?
- Have you encountered security risks due to complex sandbox configurations in practice?
Evidence
quote · @Anonymous
The need to drop privileges at all is a natural consequence of a process spawning API with inherit-by-default capability semantics. You'd never build a new VM or OS this way if you didn't require compatibility with existing software. The secure solution has always been default-nothing semantics, with whitelisted capabilities granted via explicit arguments in the process spawning API.
quote · @Anonymous
Interesting no mentioned about OpenBSD pledge(2), unveil(2). By far the easiest sandboxing out there.
Disclaimer: this card is distilled by AI from community discussions as “pain point evidence”. It is a starting point for need analysis and validation, not a “validated market need”. AI has analytical limits; please open the original discussion above to manually verify before key decisions.