search

aristanetworks / bst

A one-stop shop for process isolation
MIT License
99 stars 9 forks source link

Extend the documentation with more examples #54

Open itssamuelrowe opened 3 years ago

itssamuelrowe commented 3 years ago

I am trying to build a system like HackerRank, i.e., the code submitted by the user should be executed on the server. From what I understand, bst can be used for this.

If I run bst, it opens my shell as mentioned in the documentation. If I delete files the changes are persisted outside my isolated environment. Can somebody please explain what I am missing?

I tried changing the root with --root, but this is what I get:

samuel@Titan ~/p/bst (main) [1]> bst --root ~/Desktop/test-root ls
bst-init: execvpe ls: No such file or directory

PS: I have no knowledge about namespaces.

Snaipe commented 3 years ago

In these cases bst won't setup a root filesystem for you because there's just too much variation between use-cases. For what you want to do, there's a few options:

  1. Bind-mount the root onto itself read-only (e.g., bst -r <root> --mount <root>,/,none,rbind,ro). This of course means that your rootfs won't be mutable (so no running some package manager) but is probably the fastest way to provide a working immutable root.
  2. Copy the root dir and just enter it. If your system supports filesystems with unprivileged subvolume creation and snapshotting like btrfs, this can be extremely quick too.
  3. If your kernel allows the use of overlay2 mounts unprivileged in a user namespace, then you can use a setup script to create a discardable overlay: bst -r /mnt --setup 'mount -t tmpfs tmp /tmp && mount -t overlay overlay -o lowerdir=/,upperdir=/tmp/upper,workdir=/tmp/work $ROOT'. Most distro kernels disable this though.

All of these are still highly dependent on what you want to achieve. You could also construct a rootfs dynamically with copies and bind-mounts with an elaborate setup script too.