Sandboxing

LinSync: Sandboxing 200 Plugins with Landlock, seccomp, and bubblewrap

LinSync runs third-party document and image extractors inside a layered Landlock, seccomp, and bubblewrap sandbox so a compromised plugin cannot compromise the host.