Re: Exposing the linux namespaces API via pcntl_*

On 23/01/2019 21:15, Pedro Magalhães wrote:

I think it can be useful for a language to expose this functionality to the users for that kind of purpose (ie. run a security sensitive task in isolation, simulate certain conditions like no network access, etc..). For that end, I've put forward https://github.com/php/php-src/pull/3760 which provides an implementation of pcntl_unshare(int $flags): bool. And I'm looking for some feedback if anyone would oppose the introduction of this function (and probably setns next).

Could you give an example of how this would work in the context of a PHP process? Would it only make sense in a CLI context, when performing some kind of system task? I'm struggling to think how you'd use it in a task that would be suited to PHP, but that's probably just lack of imagination on my part. Regards, -- Rowan Collins [IMSoP]