Proposal: use slirp with unprivileged userns

[AkihiroSuda]

(demo: https://github.com/AkihiroSuda/runrootless/tree/master/misc/vde)

Slirp is slow and exposing container ports is troublesome, but I think it is ok for image building.

Another idea is to use SUID binary as in lxc-user-net, but it is less secure.

[jessfraz]

yes that would be awesome!!!

[jessfraz]

I gave you push access too if you want it :)

[AkihiroSuda]

Thank you for giving me the push access 😄

[cyphar]

By the way, we really should have an OCI hook for slirp (like CNI or netns) so you don't have to run all the commands by a higher-level management process.

[AkihiroSuda]

Yes, I think we can implement it using libslirp

[AkihiroSuda]

Looks like we should use https://github.com/google/netstack instead to avoid extra dependency

[jessfraz]

ah yeah the netstack stuff is dope :) i know @crawshaw worked on that :)