Container issues

There is a paper discussing common weaknesses of container sandboxing https://www.nccgroup.trust/globalassets/our-research/us/whitepapers/2016/june/abusing-privileged-and-unprivileged-linux-containers.pdf

From what I can say there are a number of issues that affect bubblewrap as well such as the PID Namespacing Info-Leak issue:

> While exploring unprivileged containers, the author discovered an interesting info-leak: the ‘/proc/sched_debug’ file. This pseudo-file allows an unprivileged user to view debug information for the Linux scheduler, and is not PID-namespace aware. As such, it discloses the names and PIDs of all processes running on the system (and even what their task group (cgroup) is, making it easy to identify other containers on the system and what container system is in place). The author reported this info-leak to both Docker and LXC, and it was then patched in Docker [59].