Anyone have experience with Anbox? Does it properly sandbox apps? Does it senselessly depend on a glibc host or particular container runtimes? Can you easily do one app per sandbox, or only whole Android? anbox.io
Conversation
Replying to
It doesn't provide meaningful sandboxing and doesn't approach it the way that you want. Their comparison to the Android integration in ChromeOS is also wrong / misleading. You're better off using the Android emulator for a KVM / QEMU based VM without everything hacked together.
2
Using the standard VM approach isn't substantially more heavyweight. It performs well and is much more robust and compatible. ChromeOS isn't currently using virtualization for performance reasons but they really should be doing it that way. As is, it turns ChromeOS into Android.
2
There's not really that much difference between using Android with Chrome in the app sandbox or using ChromeOS with Android inside a container. The kernel is the same, verified boot and update system is comparable, and security between apps and Chrome is essentially the same too.
2
Replying to
Yes, but I don't want any of that. Not their kernel, not verified boot, etc. Stock Linux kernel (or in the future, something better) and ability to run legacy apps safely.
1
Replying to
Anbox depends on having an Android kernel, i.e. having the Android modules like Binder. You are effectively running a whole Android OS since you've got an Android kernel and the whole userspace within namespaces. It's separated to some extent from the rest of the OS, but poorly.
Unlike ChromeOS, they aren't actually implementing a proper isolation boundary around it with the namespaces and bridging. It has moved towards that, but it's not at that point. Even the ChromeOS implementation is really just properly separated / contained, not so much sandboxed.
1
If you want to avoid turning your 'host' OS into Android, you pretty much need either a virtual machine or another approach to intercepting all the system calls. github.com/google/gvisor uses either a ptrace (quite slow) or KVM (without running another Linux kernel) backend.
2
Show replies