SAFE RIDE INTO THE DANGERZONE: REDUCING ATTACK SURFACE WITH GVISOR

Summary from the TLDR InfoSec newsletter

Dangerzone is a software that sanitizes potentially risky documents by detonating them in a container, creating a pixel map of the document, then converting that image back to a document. Prior to version 0.7.0, Dangerzone relied on Linux containers that are hardened via removing process and network capabilities, minimal user ID mapping, and syscall filtering via seccomp. To address gaps in its security posture, Dangerzone integrated with gVisor, which is an application kernel that has minimal privileges. To enable multiplatform support, Dangerzone implemented a nested container strategy where the outer container runs as a compatibility layer and the inner layer runs the gVisor and Dangerzone logic.