Subuser is a new application-packaging system that allows Dockerized desktop apps to be run as if they were regular Linux applications. It provides just enough permissions to allow the Dockerized app to interact with the local system — for instance, to work with the X11 display server — while still keeping it locked down.
Creating a Subuser app essentially involves building a Dockerized app, but with one extra ingredient: a permissions.json file that describes what the app in question can and can’t do. For common defaults used in most cases, users can set one flag, basic-common-permissions, and leave it at that.
Read more at InfoWorld
