zlacker

... as root?

>>nottor+(OP)
Given that it's within a container on a remote server, does that matter?

>>zahlma+e
I mean i hope its more hardened than JUST a container given how many container escapes there are.

>>nottor+(OP)
No root. `pip` and `npm install` don't require it.

You can not use `sudo apt install` inside it.

They use gVisor, and other container isolation mechanisms: https://ryan.govost.es/2025/openai-code-interpreter/

>>acedTr+d3
Apparently, they are using gVisor, which when applied properly, should make a pretty good isolation primitive.

>>tintor+W9
OTOH if you have apt, you have arbitrary shell commands (hooray dpkg-hooks!)

Golden years for cybersecurity people