[corv]

Interesting! The sandboxing space definitely deserves more attention.

On the other side of the spectrum, we're working on a lightweight approach that augments user namespaces with libseccomp to filter syscalls via BPF.

https://github.com/corv89/shannot

[jaytaylor]

Leash does it via eBPF today. Are you open to a collab?

[corv]

Absolutely. I’ll send you an email