Running Sandboxed Chromium in Docker Is Possible Without --no-sandbox

·12 views

The widespread advice to use Chromium's --no-sandbox flag in Docker containers is a security shortcut that disables the browser's primary defense against malicious content. Vitalii, founder of PDF-rendering service PDFik, reveals that hardened containers running non-root, capability-dropped configurations can still operate with Chromium's sandbox enabled. Chromium uses two separate sandbox mechanisms — a legacy setuid helper and a namespace-based layer — and only the former is blocked in locked-down containers. A security audit of PDFik's own infrastructure incorrectly flagged sandbox support as impossible, unaware that the namespace-based sandbox had been functioning in production all along. The episode highlights how repeated tutorial folklore about --no-sandbox has obscured the distinction between Chromium's two sandboxing methods, leading to unnecessary security compromises.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why VAT APIs Must Handle Rates, History, and Calculation Context

Adding VAT to ecommerce or SaaS products appears straightforward at first, but quickly becomes complex once edge cases like refunds, historical transactions, and product-specific rates emerge. EU member states apply standard, reduced, and zero rates differently depending on product categories such as books, food, or pharmaceuticals, making a simple country-to-rate lookup insufficient. APIs also need to account for the date of a transaction, since the rate in effect today may differ from the one used when an original sale was recorded. A further distinction exists between VAT-inclusive and VAT-exclusive pricing, as the VAT portion differs significantly depending on the price basis used. Storing calculation metadata — including country, product tax class, transaction date, and rate provenance — transforms a VAT result from a one-time response into an auditable, traceable record.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Argues Modern Cloud Platforms Are Bloated, Pitches Simpler Alternative

A developer writing on DEV Community argues that mainstream cloud platforms have grown overly complex, prioritizing new features over improving the developer experience. The piece highlights trade-offs across common deployment approaches — plain VMs, serverless functions, and Kubernetes — noting each carries significant cost, maintenance, or usability drawbacks. The author contends that only large tech companies with dedicated DevOps budgets can comfortably navigate today's cloud infrastructure landscape. As a response to these frustrations, the developer has begun building a tool called Gagarin Cloud, designed to let developers deploy web apps and dependent services with just a few CLI commands. The article positions the project as an attempt to restore simplicity to cloud deployment without requiring Kubernetes configuration or complex CI pipelines.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

SketchProxy Uses Fixed-Memory Sketches to Block API Cardinality Attacks at the Edge

A new edge reverse proxy called SketchProxy tackles high-cardinality denial-of-service attacks that can overwhelm traditional rate-limiting systems. Conventional approaches rely on centralized Redis or Memcached clusters, which can crash or fail open when flooded with millions of ephemeral IP addresses. SketchProxy, built on Go's standard library, replaces external cache dependencies with fixed-size in-memory epoch sketch tables allocated once at startup, keeping memory consumption constant regardless of attacker scale. The design addresses three key weaknesses of distributed counter clusters: memory exhaustion, network round-trip latency of 2–10ms per request, and connection pool saturation. By maintaining strict memory bounds internally, SketchProxy aims to enforce rate limits on legitimate repeat clients while surviving IP-rotation floods without an external database.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Google Ads Data Shows 3-4 Word Searches Now Drive Nearly Half of Conversions

An analysis of Google Ads query trends from January 2025 to August 2026 shows a significant shift away from short searches toward longer, more descriptive queries. One-to-two word searches dropped from 42% to 24% of impressions, while three-to-four word searches rose from 33% to 48% over the same period. The conversion shift was even more pronounced, with 3-4 word queries jumping from 20% to 46% of conversions, nearly matching shorter terms. The findings, based on data examined by Further's Jason Tabeling and reported by Search Engine Land, are linked to the growing influence of Google's AI Mode and Gemini on search behavior. Advertisers are advised to segment their search-term reports by word count and treat longer queries as a distinct and measurable source of commercial intent rather than a secondary concern.

0 comments Read more at DEV Community