Support for Docker

[sanbor]

I'm always looking for a multi-platform encryption system. Docker now it's pretty easy to install in macOS and Windows 10. I'd like to hear what do you think about using docker to run tomb. I'm sure that there are security implications by doing this.

I successfully created and opened a tomb but I'm not sure how to close it, as the container exits after creating the tomb.

This might be an interesting approach to tackle multi-platform support.

[jaromil]

interesting! never used Docker (I'm more of an LXC and KVM fundamentalist) but I do see the advantage to ease usage multiplatform and guess this can be the only way to export some of the integrity in computation that Linux dm-crypt offers into other environments that are fundamentally unsafe.

I'd say that the RNG quality is the major concern if using it mission critical, since the random generator in Win or OSX cannot be trusted at all. However there are ways to circumvent that with external RNGs.

All in all I think this is worth the effort and if you publish something I'll do my best to facilitate it into distribution. Happy hacking!

[parazyd]

Keep in mind if you wish to use the tomb outside of the container, it might be a tough nut to crack, since both Windows and OS X are incompatible with ext{2,3,4} filesystem AFAIK.

[jaromil]

If this thing goes forward I am willing to adapt tomb to work with FAT32. This may be a good occasion also to add support for other filesystems like btrfs.

[roddhjav]

I can confirm tomb works in a docker container (I did a few tests for a Travis.yml that would run the tests suite on multiple distributions).

However, correct me if I'm wrong but dmcrypt is included in the Linux kernel, the container does not have a kernel and therefore all the call to dmcrypt are executed by the host. This is fine when the host is a Linux distribution, but I fail to see how this can work on windows.

[reiven]

Keep in mind that to run a linux container on Windows, a linux virtual machine is installed, so in practice windows users will be running Tomb inside a VM.

[jaromil]

Do docker images on Win or OSX manage the VM for the users transparently? Is there some automatism to share a directory between the guest and host?

[sanbor]

@jaromil there is a way of sharing directories between Docker and the host machine. It is called volumes.

Here is an example of how you could do it: docker run -it -v $PWD:/tomb ubuntu bash

That will create a new ubuntu container with the current host directory mounted in /tomb.

[jaromil]

Cool, let us know how your experiments go. It would be nice to have an easy way to open tombs on any desktop this way.

[jaromil]

FYI https://gitlab.com/paddy-hack/devuan

[roddhjav]

Well, docker is great for testing environment (and other stuffs). However, I don't think putting tomb into a docker container (that would itself be in a VM on windows) is a good solution for a production tomb that would run everywhere. For example, I think adding support for veracrypt into tomb is a way better solution.

[jaromil]

Does Veracrypt uses LUKS and external key files? I think it has a diffferent and more complex interaction model? I have never used it.

[roddhjav]

Yes veracrypt/truecrypt can be used using an external file, no structural change is needed here. GPG recipients could be used too.

Moreover, cryptsetup can open veracrypt format (--veracrypt option) therefore a simple support for veracrypt can be added easily. However, because cryptsetup is not available on OSX or Windows a real veracrypt integration is needed for full support.

It is an important work with important changes needed in the source code to support both systems but its doable. I'm planning to work on this but I won't have the time before next month.

[jaromil]

Interesting, especially now also win10 has some more facilities for porting unix stuff. Please always consider having not only a cross-platform tomb application, but also one single cross-platform tomb format. It would hinder usability a great deal to have "different tomb formats" meaning "veracrypt tombs" and "normal tombs". As a corner case, if backward compatibility is a big issue then we may want to tag a 3.0 as not being backward compatible. I suspect this is a difficult quest and I'm very curious to see your approach.

[jaromil]

Update: I've made my journey through docker. Resulting into https://hub.docker.com/r/dyne/devuan/ and quite some fun automating stuff on Travis. This issue may also be related to #312 and in general improving compatibility of Tomb usage in Docker. I plan to setup a multiple build using Docker images in Travis, but maybe @roddhjav if you have one already you like to contribute that? I can imagine targeting major distros running our test suite.

[roddhjav]

I do have a Dockerfiles and a Travis automating stuff to automate testing of Tomb (and pass-tomb) on multi-platform using Travis. However, it has never worked very well; therefore, I have never pushed a PR. I will work on it again.

Furthermore, I would like to underline that the only purpose of this work was to be able to test Tomb on all the main distributions with Travis-CI. It has never intended to provide a multi-platform tomb for production using docker (that would not be possible anyway).

[jaromil]

ACK, I see why multi-platform likely won't be possible. Still good if not too much effort to have our tests running on more than just the old Ubuntu supported in Travis without docker.

[gregtzar]

Following a recent move from Ubuntu to MacOS I needed a way to handle tomb containers across platforms so I created a docker-tomb container and documented it's usage and limitations. There are still some wrinkles to work out but I am successfully using it to read and write from my old Ubuntu cloud-backed tomb file natively on MacOS now and it works fine for my simple use case.

[jaromil]

Nice! also I see what you mean here:

Be aware that because of the way the filestore is currently organized, the curl path will break unless the version is set to the most current. I am filing a request with them to address this.

so basically we need all releases under the same path, ACK.

[gregtzar]

@jaromil Yeah, one option to solve the file pathing would be to rename the old folder to all and keep the current release there, and then either copy or symlink it back to the main folder for convenience.

[jaromil]

Mentioning the docker-tomb in the documentation for next release.