Sandbox

bubblewrap

On Linux, use bubblewrap to isolate omnisrv and site files from host system.

#!/bin/sh
exec bwrap \
  --unshare-all --share-net --clearenv --die-with-parent \
  --ro-bind /etc/hosts /etc/hosts \
  --ro-bind /etc/resolv.conf /etc/resolv.conf \
  --ro-bind /home/user/go/bin/omnisrv /omnisrv \
  --ro-bind /home/user/site /site \
  /omnisrv -addr localhost:8080 /site

Jails

To be done.

Docker

To be done.