Tree Sandbox

"Tree-shaped" sandbox: multi-layer nesting and branching, like a “tree” composed of multiple sub-containers. A sandbox is composed of multiple layered sub-containers. With this design, “untrusted” procs and “semi-trusted” procs run in different layers of a sandbox; User's app and other companion procs run in different layers.

With the “containers tree” model, we can isolate procs of different "classes" inside the sandbox without requiring host subuid/subgid.

No root needed; no system daemon; no host caps or suid.

Image-free containers. Tools like vim/git don’t need to be reinstalled inside.

Integration of common tools (eg isolated X11 server, DBUS filter proxy etc.), and common socket path mounting options.

Works out of the box (for a basic-system sandbox).