> Its main purpose is to significantly reduce bandwidth and thus both increase browsing speeds and decrease bandwidth costs.
How does it reduce bandwidth exactly? It still has to grab all the html/css/js for the site being rendered.
How does it reduce bandwidth exactly? It still has to grab all the html/css/js for the site being rendered.
As well SSH/Mosh access there's a HTTP service, that currently only outputs static, noninteractive HTML and basic graphics. For example: https://html.brow.sh/https://news.ycombinator.com/item?id=17...
So if OP goes down this road then I think he should allow users to access machines.
Do you think such a service would be significantly different to an email service in terms of privacy concerns?
If you weren’t the fine upstanding person you are, you’d have all the web traffic of users at your disposal: banking, secure interactions with healthcare providers, credentials to Hacker News, the whole nine yards.
With access to my email, you could probably reset a handful of my passwords to various services that don’t support dual factor auth, and you could probably discover what services I subscribe to.
I mean, I wouldn’t want you to have access to my email, but I would much rather that than a permanent man-in-the-middle web client.
Maybe something like:
https://github.com/rkt/rkt/blob/master/Documentation/running...
for VM backed containers - but I'm not sure if it's considered stable and/or secure.
But hw isolation might be worth investigating - as others are saying - hostile access to a web browser, including webmail etc - is pretty dangerous. And plain docker never had a good story wrt secure isolation.
Apparently there was "hypernetes", now stackube - for combining VM runtime and kubernetes:
https://kubernetes.io/blog/2016/05/hypernetes-security-and-m...
https://github.com/openstack/stackube
As far as I can tell, this allows the mix of k8 style pod/container management and VM level isolation:
https://stackube.readthedocs.io/en/latest/stackube_scope_cla...
As for lxd/freebsd jails and zfs - both offer very nice and easy to grasp environment for isolated services - and both should end a little more isolated than a typicaldocker setup (some services running as root in container, no additional lxc restrictions).
But all things considered, if you already have k8/docker set up to give every user a separate, possibly ephemeral container... Infrastructure is probably not where I'd devote most time. It should work well enough as is.