demos/bubblewrap-shell.sh: Unshare all namespaces

Lets demo things as sandboxed as possible. Closes: #154 Approved by: cgwalters
containers · Jan 17, 2017 · a6e1516 · a6e1516
1 parent 06a7f31
commit a6e1516
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/demos/bubblewrap-shell.sh b/demos/bubblewrap-shell.sh
@@ -19,6 +19,11 @@ set -euo pipefail
       --symlink usr/sbin /sbin \
       --chdir / \
       --unshare-pid \
+      --unshare-user-try \
+      --unshare-ipc \
+      --unshare-net \
+      --unshare-uts \
+      --unshare-cgroup-try \
       --dir /run/user/$(id -u) \
       --setenv XDG_RUNTIME_DIR "/run/user/`id -u`" \
       --setenv PS1 "bwrap-demo$ " \