Boxxy puts bad Linux applications in a box with only their files

https://github.com/queer/boxxy

by icar • 2 years ago

182 85 2 years ago

github.com

M95D• 2 years ago

GoboLinux users might be very interested.

qalmakka• 2 years ago

Isn't this basically what `bubblewrap` already does?

bubblesnort• 2 years ago

Combinations of bwrap, chpst, env, setpriv, and setsid can become unreadable gibberish but otherwise work fine. There's lots of similarly useful stuff that can be combined for specific needs.

johnisgood• 2 years ago

Or firejail?

ruthmarx2• 2 years ago

People love to reinvent the wheel *shrug*

andrewla• 2 years ago

This seems significantly more lightweight than bubblewrap -- it doesn't attempt to do much in the way of containerization or isolation, just remapping certain files. I feel like this could be done in a small shell script if you reduce the configurability.

INTPenis3• 2 years ago

Is this like a better version of toolbx? Because I love toolbx and use it daily, but I wish it allowed for more granular configuration.

For example I'd want to create more containers for more specific use cases where they only have access to specific dirs in my HOME.

abhinavk2• 2 years ago

Try distrobox. The default behavior is like toolbx but you can change home folder to ~/distrobox/appx or go all-out and unshare everything.

https://github.com/89luca89/distrobox

INTPenis3• 2 years ago

You mean combining the --unshare-all and the --volume arguments to create my own list of HOME dirs to share? The docs are really sparse, lots of examples that use --unshare-all but nowhere do they explain it.

HeatrayEnjoyer• 2 years ago

I don't do drugs, mmm-nnn.

OmarAssadi• 2 years ago

I was right about to go to another site and had to do a double-take when my eyes caught the title; I hadn't thought about her in YEARS. I hope it's boxxy on purpose.

Semaphor2• 2 years ago

It is not https://news.ycombinator.com/item?id=34730942

No! I just thought it was a cute name ("put things in a box"), and it wasn't a common repo name on GitHub.

BoringTimesGang• 2 years ago

I hope it's boxxy on purpose.

The default branch is `mistress`, I suspect the author has a sense of humour.

dsmurrell• 2 years ago

Beetles.

dloss• 2 years ago

Related question: Which software do you recommend to sandbox a locally running AI agent, so that it can only access parts of the filesystem (e.g. one folder) and an allow-list of URLs?

ravetcofx• 2 years ago

Chroot or AppArmor+Firejail

BonusPlay• 2 years ago

Depends how much patience you have.

Firejail if you want ease of use (there are a lot of ready profiles to be used).

Bubblewrap if you want more security, at the cost of having to do more manual work.

TL;DR Firejail is a blacklist of things, while bubblewrap is an whitelist, so bwrap policies tend to be tighter.

OJFord• 2 years ago

That depends on the profile, firejail supports both.

amelius• 2 years ago

What are people using to quickly test new ML models from github in a sandbox?

Do you fire up a docker image? Do you use virtualbox? ...

stavros5• 2 years ago

What's allowing the AI agent to access files at all in the first place?

dmd• 2 years ago

People ascribe magical powers to them.

okasaki• 2 years ago

Why not docker?

Semaphor2• 2 years ago

Lots of comments in the thread from February 2023: https://news.ycombinator.com/item?id=34730520

_cenw4• 2 years ago

boxxy is a part of the amyware discord server.

Can we reverse this trend? I've recently started to see an FAQ, on GitHub, hide the answer with a deeplink into Discord channels where you needed to find the guild to join first. I've never gotten disinterested in a project that fast. This needs to stop.

Kiro• 2 years ago

I disagree. The only time I'm actively engaging with a project is if it has a Discord server. I don't want to post questions in a public forum.

freedomben• 2 years ago

I don't want to post questions in a public forum.

Why?

stavros5• 2 years ago

Especially Discord "forums", the black hole of the internet. Neither real-time so I can get my question answered when I'm there, nor open enough to find old questions through Google, nor popular enough that people browse through them to answer.

People go "oh, Discord has forums, we don't need a web forum", and the world is now a little bit worse.

Y_Y2• 2 years ago

Maybe there's value in (semi-)automated discord exfiltration. Like A browser plugin that grabs all the data from any discord pages I look at and mirrors it somewhere on the open web.

lupusreal2• 2 years ago

I think discord serves a functional quite like email mailing lists, but with a twist. Email mailing lists, by their nature, gatekeep and filter out younger or less technical people, while discord by its nature is doing the same but inverted. It filters the sort of people that would be far more comfortable with mailing lists.

tourmalinetaco4• 2 years ago

This is it exactly. Discord is, inherently, where quick gratification prospers. Immediate memetic responses followed by swapping to the next server for the next high.

_cenw4• 2 years ago

It's okay-ish for when you need to ask questions. But we're trending towards gating binaries and general documentation there too.

Discord must be aware that their secret ingredient is that people are "admins" over others, and that people actually quite like being in power and having a different colored name. And all that without the technical barrier of having to setup forums or Teamspeak (not that such gatekeeping kept terrible people from being admins)

Gormo2• 2 years ago

That sounds awful. You want a venue where younger and less technical people can get help and guidance from the more experienced people, not an echo chamber full of the least experienced users.

herculity275• 2 years ago

Is there a reason why projects opt for a Discord server rather than setting up a subreddit? Is it simply because Discord is easier to moderate?

arbitrage• 2 years ago

Reddit attracts a lot of trolls. Managing the reddit takes work (moderation, keeping up with stupid reddit drama).

With a project discord, you're filtering out people immediately -- typically only people who want to be there wind up there. It makes things easier for a lot of people this way.

Gormo2• 2 years ago

Anything would be better. A subreddit, a traditional web forum, a mailing list, an NNTP group, an IRC channel -- I'd take any of them over Discord.

NegativeK• 2 years ago

To pile on, from what I've seen, Reddit is shit for a community of people getting to know each other.

Posts aging out mean that discussions fade from view. That means that they die off, as other people don't join in. Combine that with karma, and you get people tending to just contribute content that is counter to community building.

I've seen some similar stuff happen on Discord servers (I'm looking at you, Discord servers with 50 topic channels), but I've also seen people slowly get to know each other better there.

Or, to summarize: I generally see Reddit as better for discoverability and Discord as better for community. But they're both inadequate as a whole.

blueflow3• 2 years ago

From the README:

  It wants to put its config in ~/.tmux.conf. With boxxy, you can put its config in ~/.config/tmux/tmux.conf

From tmux(1):

  By default, tmux loads the system configuration file from /etc/tmux.conf, if present, then looks for a user configuration file at ~/.tmux.conf $XDG_CONFIG_HOME/tmux/tmux.conf or ~/.tmux.conf.

XDG_CONFIG_USER defaults to "$HOME/.config".

Very poor choice for an example.

denotational• 2 years ago

This is a (relatively) recent addition to tmux, I remember this being an annoyance a while ago, and you can find the discussion on GitHub if you search.

blueflow3• 2 years ago

Heh, but if its in Debian stable then its probably not recent.

Fnoord2• 2 years ago

I've been using symlinks for Vim and Tmux for ages and waited for them to catch up. Seems they've done it, finally.

scoot• 2 years ago

then looks for a user configuration file at ~/.tmux.conf [...] or ~/.tmux.conf

If the tmux devs are confused then it looks like a perfect example of why we need a standard for `.config` or similar. I have proposed something similar in the past for code repositories to remove the config file clutter to a subdirectory, but it's hard to gain traction.

jraph• 2 years ago

This looks like a careless mistake to me, not really a fundamental confusion :-)

blueflow3• 2 years ago

it looks like a perfect example of why we need a standard

A standard wouldn't fix mistakes in the manpage. What is your proposal?

akira2501• 2 years ago

I took the message to be is that your home directory doesn't actually belong to you and you should store most of your work elsewhere on the system.

Now I just have a `/work` folder and I don't have to care what applications want to do with their configurations.

krageon• 2 years ago

It's a well-known tool and the example is one which people will very often encounter. A lot of tooling is terribly behaved, regardless of this specific example.

hughesjj• 2 years ago

Same for .aws (the motivating example), kind of

https://docs.aws.amazon.com/sdkref/latest/guide/file-locatio...

I don't see an option for the whole .aws folder. I'm sure some random stuff gets out in there, but for the life of me I can't think of any other files besides credentials and config.

Maybe some credential provider scripts/hooks? But in that case i think you can just specify the location wherever it is already... IDK.

The biggest utility I could see boxxy for is when other tooling doesn't honor those env cars/alternate configs from default. But... I mean symlinks always worked fine for me.. but I gotta admit this is better, and I'm thinking about installing it just to see what boxxy scan comes up with. I recently did a bunch of work to clean up my devenv and get it in .zshenv, this could help with that.

eithed2• 2 years ago

Love that the user name in examples is mistress

ordu• 2 years ago

I believe it is the default branch of git called 'mistress' instead of 'master' or 'main'.

eithed2• 2 years ago

Oh... tbh I've never thought about master this way. I just imagined the conversation: > mistress - it puts paths in `.config` > boxxy - yes mistress

notamy2• 2 years ago

Yes! GitHub username queer with default branch mistress was too good of a bit to pass up.

demomode• 2 years ago

FYI. There is a XDG checker called "xdg-ninja"[1]

A shell script that checks your $HOME for unwanted files and directories.
When xdg-ninja encounters a file or directory it knows about, it will tell you whether it's possible to move it to the appropriate location, and how to do it.

1. https://github.com/b3nj5m1n/xdg-ninja

itsthejb• 2 years ago

Indeed. Although this tool looks like a way to work around those holdouts which refuse to provide an official customisation point

notamy2• 2 years ago

Oh this is my project! I haven’t had energy to work through pending issues for a while due to health reasons; I do still have interest in maintaining it but my health makes it a struggle.

jcmfernandes• 2 years ago

I'm sorry to hear that. Thanks for the tool and wishing you a speedy recovery!

junon• 2 years ago

Sorry to hear that. Amazing GitHub username by the way.

justinmarsan• 2 years ago

I don't know if the reference was on purpose, but I now have this 13 years-old remix on repeat : https://www.youtube.com/watch?v=LHNZVAjadqY

dredmorbius• 2 years ago

No relation: <https://news.ycombinator.com/item?id=34730942>

cdelsolar• 2 years ago

OMG boxxy

yellowapple• 2 years ago

On a tangent: it bugs me that the default XDG directory structure doesn't fully match the standard Linux directory structure. What's with these inconsistent defaults?

    XDG_DATA_HOME="$HOME/.local/share"  # okay, reasonable
    XDG_CONFIG_HOME="$HOME/.config"  # ...uh, pardon?
    XDG_STATE_HOME="$HOME/.local/state"  # well at least it's in ~/.local
    XDG_CACHE_HOME="$HOME/.cache"  # ...but this one ain't; what in tarnation?

It'd make more sense to be consistent with how system-wide applications use /usr or /usr/local, like so:

    XDG_DATA_HOME="$HOME/.local/share"
    XDG_CONFIG_HOME="$HOME/.local/etc"
    XDG_STATE_HOME="$HOME/.local/var/lib"
    XDG_CACHE_HOME="$HOME/.local/var/cache"

This would make $XDG_(CONFIG|STATE|CACHE)_HOME consistent with $XDG_DATA_HOME, and also consistent with existing conventions around ~/.local/bin and ~/.local/lib.

The XDG spec ain't the only naughty naughty boy here, either. Flatpak puts all of its application data in ~/.var/app, whereas it'd make a lot more sense in ~/.local/var/lib/flatpak/app. And of course, the subject of Boxxy (and, as others mentioned, xdg-ninja) is the countless apps contributing further to the chaos.

Of course, all this would stop being an issue entirely if Linux would just embrace union mounts like Plan 9 did and overlay everything onto /bin, /lib, /share, /etc, and so on. Hell, if I were the not-so-benevolent dictator for life of the Linux ecosystem I'd take the opportunity to rename all those weird UNIX™ vestiges, too, like /etc→/conf and /var→/data - but if we're gonna hang on to those vestiges, the least XDG could do is encourage consistency with them.

Maybe I just need to make my own distro and finally say goodbye to what little remains of my sanity.

eviks• 2 years ago

alias aws="boxxy aws"

That's rather inconvenient to alias ever app, is there a more ergonomic way to rewrite the file access calls?

Boxxy puts bad Linux applications in a box with only their files

Related Stories