I've been saying that for a while. We need a viable third option.

But it is not easy, and it takes a huge amount of effort. As others have said, theres SailfishOS, Ubuntu Touch, PostmarketOS and a few others.

I'm not sure which one is in a better position to become that third alternative we need, but this year I'm experimenting with all of them on different devices, to try to understand where they stand.

"posted from an Ubuntu Touch mobile device"

It seems a very reasonable outcome. I'm glad extremes didn't prevail.

HTTPX2 isn't a great name for a fork (or at all). Just leads to more confusion.

Nevertheless, I'm curious about the pros and cons when comparing with "niquests".

This is actually an excellent idea. Well done.

Some other comments suggested https://cortecs.ai/. I never tested it, but from a brief look, it does seem a viable alternative.

Thanks for the suggestion.

Yes, there's SailfishOS, there's Ubuntu Touch, and a couple more. It would be nice if one of them could gain traction so people can have a third choice.

> Graphene lets you run them.

It seems not all of them, and that things will only get worse if recent news comes true.

I'm impressed with the score. This is a model that runs on a good, but still regular, desktop PC.

The other day I saw this: https://nono.sh/

Haven't tested it yet, but it seems to address the same issue as Docker Sandboxes, but in a different way.

I have tested it and the big advantage is that is has access to the local development tools.

But it’s not as well sandboxed for sure.

Nono has been my daily driver since the start of the year. It's not a perfect sandbox -- that's for sure. For example, the default network rules let you escape via a global TMUX server. But it is extremely practical. It gives me enough guarantees to feel confident about running in YOLO mode. So far nothing has gone awry.

Why do you say that?

Eg, if used with Colima in macOS, it means I can run a devcontainer in an isolated VM and Nono inside the devcontainer can restrict a lot what can and cannot be done.

You get credentials proxying and network outbound limits.

How is Docker Sandbox better sandboxed?

Yeah but that’s Colima and Nono then. Not only Nono.

True. But it's also an illustration of how relying on an OS' native sandboxing capabilities is nicely composable with other isolation techniques.

As you as your Go build fails because you haven't put the local cache dir in the "allowed directories", you'll understand how painful this is, as well as most tools based on bubblewrap/sandbox-exec. There is a difference between a clean environment with standard setup vs a layer on top of everyone's existing tools/setup, especially in a enterprise environment.

(I'm sure you can spend time to come up with a proper bubblewrap configuration that allows go build to succeed, but it's probably not worth the effort.)