Some questions:
- Do they provide their own implementation of containers or
rely on some already existing (docker, rkt, etc)?
- How containers communicate? what protocol?
- How filesystem is handled? Containers have volumes for file system sharing?
- What's the plan for devices management? How my USB
pendrive, speaker or webcam is available inside a
container?How persistent data will be managed isn't detailed in the document.
Seccomp-bfp is a good enhancement. It can really fix the well know security issue of docker when using volumes with write permissions.
Still wondering what's the plan for persistent data. If someone has more info, please share :)
It's a bit less ambitious than it sounds, though, as it's not really a different operating system (such as sel4) but a Linux distribution with armouring, secure defaults, Tor, and some useful userland software. Running the PDF viewer in secure isolation is a nice touch.
It says that higher-level languages are preferred for the userland software but doesn't say which language?