FailFS: Linux’s sandbox that erases the filesystem
A Hackaday piece introduces FailFS, a tiny Linux kernel pseudo-filesystem due to land in Linux 7.3. It makes almost all filesystem operations fail (returning EOPNOTSUPP), so a process’s pathname lookups break when FailFS is used as root or CWD; applications must operate from explicit directory descriptors (e.g., openat) and anything not reachable from those descriptors doesn’t exist. This lets sandbox managers give a program only the pieces it needs, but it also blocks launching standard dynamically linked binaries since absolute loader paths don’t work. NULLFS is mentioned as a separate immutable layer. Overall, FailFS is a minimal, deny-by-default filesystem that aids containment but is not a complete security solution.