Interception
Simple Story
The three Linux layers each stand between the pupil and what they asked for.
The pupil asks for something and, instead of reaching the thing they asked for, they reach whoever is standing there first. Two of them hold a doorway, the kernel and the linker. The third holds none at all: it watches the clock.
What it is
Every Linux-based layer works by putting itself between the supervised program and the resource it requests, but each does so at a different level:
| Layer | Interception point |
|---|---|
| Bubblewrap | The kernel. A mount namespace gives the process a different view of the file system. |
| LD-Preload Firewall | The dynamic linker. Socket symbols resolve to libnetblocker.so before they reach libc. |
| Timeout | Signal delivery. The wrapper sends a signal once the budget is spent. |
This is the same idea as a pointcut in the aspect-oriented programming (AOP) layer, moved outside the Java Virtual Machine (JVM).
Further reading
ld.so(8)— Linux manual pagemount_namespaces(7)— Linux manual page- containers/bubblewrap — source repository