Thanks for your work.
It closes the operational gap between simple chroot environments and full virtualization platforms such as Xen.
I am also curious: What hardware enhancements would benefit 'lightweight, kernel-enforced isolation' ? Do we need memory tags? HW Capability Lists? ?
( I believe we've concentrated far too much in making "damn fast pdp-11s" with our hardware advances, and far less on building Reliable Systems -- even if a few percent of peak possible performance is consumed by extra HW. )
I think this can make a lot of sense, because there are many situations, in particular in embedded systems, where you can and should confine at a much smaller scale than jails are really convenient for.
It will also be interesting to see if "Cells" can make inroads in the territory the original ACL abandoned, because writing the rules was so complex that it amount to parallel meta-anti-software development.
Hat tip to Matthias from here.
I probably won't be using it because my core investment on FreeBSD does what I need but I think it's interesting.
I use FreeBSD jails and get a lot of value out of separate network stacks for each (vnet jails).
Would the NetBSD approach here be to lean more heavily on your lan infra to register hostnames with static addresses (pointing at NetBSD host) and then run a host proxy to forward & port-map to the relevant cell? Or is this the wrong kind of use-case for cells?
I use bastille, and it seems to "just work" and I looked at Sylve and it had huge potential. When I ask for some ELI5 on bridge/net stuff, I don't get traction so my confusion remains.
I think a lot of people enable NAT methods which aren't that far removed from a host proxy or port-map. I don't like NAT (see comment above about k8s)
