len(pics) either already knows about the length or it needs to count so it’s O(n)

you can use xmllint for xml via xmllint —-xpath

It’s great as it is included by default in RHEL/Fedora

This is literally always how iOS has worked. You can refer to the application lifecycle documentation: https://developer.apple.com/documentation/uikit/managing-you...

What point are you trying to make. The documentation doesn't say the OS only keeps a single app process running at a time.

The document is clear that the expectation from the developer is that you need to be ready for your app to be snapshotted and frozen/killed at any moment when it is not on the foreground.

The page you linked to doesn't say that anywhere.

How does typing a url stop that?

type out: https://thisislegitparkingpaymentwebsite.com

Is this goatse or is it the real payment website for your parking? You won’t know unless you go there

Linux can be configured to disable memory overcommit

sysctl -w vm.overcommit_memory=2 sysctl -w vm.overcommit_ratio=50

It is probably a bad idea to do that though as it will limit the amount of virtual address space an application can use

Note that the fork()/execve() semantics of Linux pretty much depend on memory overcommit. You may get weird OOM crashes when there is seemingly no memory pressure, if you turn overcommit off.

In the short time between fork() and execve(), the new process duplicates the entire virtual memory of the old one. None of this is physically allocated due to copy-on-write, but still all counts as virtual memory.

Has anybody tried a compromise? Like, the program forks and overcommit is ignored for it for a 1 second grace period? I know it would be more complicated than that, but something along those general lines.

Docker uses VMs in non-Linux OS to provide a Linux where containers can actually exist

bubble wrap is just doing the same cgroups work

Depending on the configuration, bubblewrap can substantially reduce the attack surface.

It doesn’t change the fact a malicious process is still attacking the same kernel , but it can reduce what it can do to that vm.

podman run --annotation=run.oci.handler=krun -dp 8080:8080 -t --rm server-without-wasm

Yes, you can run Podman with different OCI runtimes, in the same way as you can run Docker with different OCI runtimes, and some of these OCI runtimes are microVM-based.

This is not what the person I was responding to is doing, though.

As for differences between the krun OCI runtime and Docker Sandbox (which also uses libkrun), let's please continue the discussion here: https://news.ycombinator.com/item?id=49240662 .

Do you mean like Podman has supported for years…?

eg: https://josecastillolema.github.io/podman-wasm-libkrun/#libk...

Do you mean like Docker has supported for years…? (Just configure krun as Docker's OCI runtime.)

Obviously, there's a reason why Docker released Docker Sandbox as a separate product:

- Barely anyone bothers to configure Docker/Podman with a different OCI runtime like krun. Heck, most people don't even know about OCI runtimes in the first place. Case in point: Most people here in this HN discussion are proposing using "standard" containers (with the default OCI runtime) for sandboxing. This is what I was trying to get at.

- A sandbox for agent needs tighter network control.

As for differences between the krun OCI runtime and Docker Sandbox (which also uses libkrun), let's please continue the discussion here: https://news.ycombinator.com/item?id=49240662 .

    from subprocess import run
    from sys import argv

    source = argv[1]
    destination = argv[2]

    run([
      "rsync",
      "-zavp",
      source,
      destination
    ])

vs

    #!/usr/bin/env bash

    source="$1"
    destination="$2"

    rsync \
      -zavp \
      "$source" \
      "$destination"

the overhead is not really that bad imo

That's not really what people mean. Your example isn't accurate because you just ran bash two different ways.

subprocess.run() uses Popen and defaults shell=False. There is no shell process involved. As the other user already pointed out.

Huh? The Python example does not use Bash or the shell in any way.