I wanted keryx to make reels without ever seeing a disk, so FFmpeg went into a Wasm sandbox. Then I wanted the hardware back. The escape hatch I planned turned out to be french doors: a native engine, same afero filesystem, no shell. And I made myself write down the cost. #golang
phpboyscout.ukThe escape hatch that turned out to be french doorsHow a plan to sneak hardware access into a sandboxed FFmpeg became a second native engine, still fenced to a filesystem you hand it, with the security cost written down honestly.
0 reposts0 likes