In this lesson we're going to be discussing
application sandboxing,
also known as application containerization.
This approach to software development and management
creates a safe environment
for running and testing computer code
that keeps users and production environment safe.
Now the term sandbox usually comes from
the idea of a child's sandbox,
in which the sand and the toys
are kept inside a small container or walled area
so the children can play safely without making a huge mess.
Now, with the sandboxing approach,
every software application is given its own unique sandbox
which is a controlled, restricted environment
for them to run and execute their code.
This environment helps developers isolate
and protect system resources from malware
and other kinds of cybersecurity threats.
Using this method, it's easier to identify
how a software behaves and spot any malware
or other undesirable program elements
that may be running.
Application sandboxing is there to help improve security
by isolating and shielding the application
from outside intruders and malware as well.
This kind of separation helps create a secure environment
so the app can run without the risk
of damaging the overall system.
This approach is especially useful
when you're running or testing applications
from untrustworthy sources or websites.
Now sandboxing also increases application integrity
because it lets the developers
wrap the application in security policies
and isolate and protect the application
within its own virtualized environment.
Now to provide sandboxing of your applications
on analytics system you're going to use
either snapd, Flatpak or app control.
Let's take a look at each of these.
The first one we're going to look at is known as snapd,
which is part of snaps,
which is a form of application sandboxing.
Now a snap is really a bundle that contains an application
and its dependencies that work without modification
across all Linux distributions.
By using snaps, you're going to receive an easy to install
secure cross platform and dependency free application
that you can then run on your system.
Now to manage and maintain your snaps or applications,
you need to run the snapd or snap daemon
on your Linux system.
Now, once the snap framework is installed,
you're going to have the snap command and the snapd command
available for use.
The snap command can be used to find a snap
or application that you want to install,
similar to other package managers you may have used.
Now, for example, let's say you enter
snap find "media player."
You're going to get back a list
of all the different media players
that are available to download as a snap bundle.
Now, if you want to install a media player like VLC,
you can do that by entering sudo snap install VLC
and pressing enter.
And then it's going to download and install VLC
onto your system as a sandboxed application.
Now, by default, the applications are going to be installed
under the /snap/ bin directory.
So in the case of VLC, if you want to run it
you're going to need to add the /snap/bid directory
to your Systems environmental path variable,
or you're going to have to switch that directory
and run it from there.
Now, when it comes time to update an application,
you can easily do that by entering sudo snap refresh VLC,
as an example.
And that way the VLC application
will be replaced with the latest version.
Snapd as I said is really the backend daemon
that runs the snaps for you on your system.
Now, unfortunately by default,
snap doesn't come pre-installed on set OS,
but you can install it using the yum package manager
and entering the command sudo yum install snapd.
Now once you've installed snapd,
you're also going to need to enable network communication
for the snapd utility by entering
sudo systemctl enable -- now snapd.socket.
The second command we need to cover is known as Flatpak.
Now Flatpak, just like snaps,
is a universal packaging system
that lets you distribute, install and manage software
without need to worry about the dependencies, runtime
or specific Linux distribution that's being used.
For this to work Flatpak runs in an isolated environment
known as the sandbox that contains everything needed
for that program to operate.
Again because these apps are sandbox,
they cannot affect your underlying Linux operating system.
And this provides you with better security
than directly installing these apps using yum
or other package managers
that don't sandbox the applications.
To run Flatpak, you're simply going to enter
Flatpak [options] and the command.
The third command we need to cover is known as App Image.
Now App Image is another application containerization
or sandboxing tool.
This is yet another universal package manager
where the apps are going to be installed
without modifying your system libraries
or system preferences.
With App Image,
you simply download the packages that you want to run
and then you run them without installing them.
Because of this, these are called portable apps.
And because they're portable,
you can really run them from anywhere
on your operating system.
And because of that,
you'll often end up with App Image files
all over your hard disc if you're not careful,
because they can really run from literally anywhere.
Personally, I recommend that you create a directory
under your home directory called applications
and put all your App Image applications in there
so they're all in one place.
App Image packages are usually going to be run
from within your graphical user interface too.
So as long as that file is set to executable,
you can simply double click on the App Image package
and load it up and run that program.
Now, if you want to be fully integrated
into your graphical user interface
you should install the App Image daemon or App Image D
which will allow it to go into the context menus
and other places just like any other program.
Now, as you can see, there are lots of different ways
to accomplish the same thing in Linux.
And when we talk about application sandboxing,
we really do this using either snaps, Flatpak or App Image
as the common ways to conduct this
on your Linux servers and workstations
to increase the overall security of your devices.