EmbeddingGemma 2: an open, lightweight multimodal embedding model
deepmind.google·6d ago
AI Engineering
Hacker News·20d ago·5 min read
Show HN: Drop – a rootless Linux sandbox with gVisor support
TL;DR
Drop is a rootless Linux sandbox that leverages gVisor to isolate programs, ensuring that malicious actions are contained within the sandbox environment. This allows users to install and run third-party applications without risking their actual home directory or user account.
✦ Why It Matters
Consider using Drop to safely test third-party applications without compromising your system's security.
Key Takeaways
- Use Drop to isolate third-party programs safely.
- Leverage gVisor for additional security against kernel vulnerabilities.
- Create disposable environments easily with Drop's configuration.
- Run coding agents without risking your actual home directory.
How It Works
Drop operates within a Linux user namespace, creating isolated environments for running programs. It drops user namespace capabilities before executing any sandboxed program, preventing privileged operations.
The integration with gVisor adds an extra layer of security by acting as a user-space kernel, which restricts programs from accessing the host kernel directly.