From a security perspective, virtual machines (VMs) and sandboxes are methods of providing isolation. They have other uses as well, but in this post I'm going to focus on this ability to provide isolation.
So what exactly does "isolation" mean? Isolation is the ability to run an application in such a way as to limit its access to other programs or data on your computer. Basically it means preventing an application from being able to modify files on your computer or interact with other applications. In practival terms, for example, it can mean preventing a virus you receive via email from infecting your computer.
So what is the difference between a Sandbox and a virtual machine? Conceptually they are similar, but they are implemented very differently and provide very different flavors of protection.
Virtual machines (e.g. VMWare, Xen, VirtualBox) provide a way of running a whole separate virtual computer in your computer. It literally is a completely different computer - it will have different applications, different files, even a different operating system (e.g. you can run Linux virtual machine on a Windows computer).
Sandboxes (e.g. Sandboxie, sandbox-exec) are ways of running an application on your existing computer but selectively restricting what it can do. So you could sandbox your email client so that it can't write files to your disk, but it can open URLs in your web browser.
For more, visit the source of article
Reply With Quote
Originally Posted by Avinash
