Davíð Steinn Geirsson
7b60a0d688
Design for adding strong sandboxing to vm-switch using Linux namespaces and seccomp, with per-VM process isolation. Key elements: - Fork per VM instead of threads, each child sandboxed - SPSC ring buffers for inter-process frame routing - Unprivileged operation via user namespaces - seccompiler + nix for pure Rust implementation - Asymmetric control protocol preventing MAC spoofing Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| 2026-02-08-vm-switch-sandboxing-design.md | ||