haraldrudell
commented
7 years ago Now imports by distro, sudo no longer required
These containers will always run:
- without writing to the hosts's root file system
- with user separation
- with separate network
- with separate processes
It can run with no network lxc.network.type = empty Somehow it doesn’t presently run with shared network lxc.network.type = none
Neither will it run with shared processes lxc-start --share-ipc 1… but unprivileged containers probably can’t do that
#!/bin/bash -eu
# © 2017 Harald Rudell <harald.rudell@gmail.com> (http://haraldrudell.com) ISC License.
while [ $# -ge 1 ]; do case "$1" in
--help) echo "lxc-unpriv [--name=name]"; exit;;
--name=*) NAME="${1#*=}";;
*) echo >&2 "unknown options: '$*' usage: lxc-unpriv [--name=name]"; exit 2;;
esac; shift; done
if [ ! "${NAME-}" ]; then NAME=`hostname --short`-`date --utc +%y%m%d-%H%M%S`; fi
echo "Creating unprivileged container $NAME …"
config=~/".local/share/lxc/$NAME/config"
lxc-create --template=none --name="$NAME"
if [ ! -s "$config" ]; then echo >&2 "Container configuration file missing: '$config'"; exit 1; fi
echo "Container configuration file: $config"
rootfs=~/".local/share/lxc/$NAME/rootfs"
sed --in-place "1i# Container created on: `date --utc +%y%m%d-%H%M%S` by lxc-unpriv © 2017 Harald Rudell <harald.rudell@gmail.com> (http://haraldrudell.com) ISC License.\n# lxc-unpriv: `stat --format=%y "$0"` sha256: `sha256sum "$0" | cut --delimiter=" " --field=1`" "$config"
root_uid="`sed --silent 's/^\s*lxc.id_map\s*=\s*u\s*0\s*\([0-9]\+\).*/\1/p' "$config"`"
root_gid="`sed --silent 's/^\s*lxc.id_map\s*=\s*g\s*0\s*\([0-9]\+\).*/\1/p' "$config"`"
[ "$root_uid" -gt 0 ] && [ "$root_gid" -gt 0 ] || { echo >&2 "Failed to parse lxc.id_map in config file '$config'"; exit 1; }
echo "Container root group and user mapped to host: $root_uid:$root_gid"
cat <<EOF >>"$config"
lxc.rootfs = $rootfs
lxc.utsname = $NAME
lxc.pts = 1024
lxc.cap.drop = sys_module mac_admin mac_override sys_time
lxc.aa_profile = unconfined
lxc.mount.entry = /bin bin none ro,bind 0 0
lxc.mount.entry = /etc/init.d etc/init.d none ro,bind 0 0
lxc.mount.entry = /lib lib none ro,bind 0 0
lxc.mount.entry = /sbin sbin none ro,bind 0 0
lxc.mount.entry = /usr usr none ro,bind 0 0
lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
EOF
DISTRO=`lsb_release --id --short` && DISTRO="${DISTRO,,}" # ubuntu
COMMON="/usr/share/lxc/config/$DISTRO.common.conf" && if [ -f "$COMMON" ]; then cat <<EOF >>"$config"
lxc.include = $COMMON
EOF
fi
USERNS="/usr/share/lxc/config/$DISTRO.userns.conf" && if [ -f "$USERNS" ]; then cat <<EOF >>"$config"
lxc.include = $USERNS
EOF
fi
if [ -d /etc/sysconfig/network-scripts ]; then cat <<EOF >>"$config"
lxc.mount.entry = /etc/sysconfig/network-scripts etc/sysconfig/network-scripts none ro,bind 0 0
EOF
fi
if [ -d /etc/rc.d ]; then cat <<EOF >>"$config"
lxc.mount.entry = /etc/rc.d etc/rc.d none ro,bind 0 0
EOF
fi
if [ "$(uname --machine)" = x86_64 ]; then cat <<EOF >>"$config"
lxc.mount.entry = /lib64 lib64 none ro,bind 0 0
lxc.arch = x86_64
EOF
fi
DIRS=(); for D in bin etc/init.d etc/rc.d etc/sysconfig/network-scripts home lib lib64 proc root sbin sys tmp usr var; do DIRS+=("$rootfs/$D"); done
mkdir --parents "${DIRS[@]}"
touch "$rootfs/etc/fstab"
ln --symbolic "$rootfs/run" "$rootfs/var/run"
cat <<EOF >"$rootfs/etc/passwd"
root:x:0:0:root:/root:/bin/bash
EOF
cat <<EOF >"$rootfs/etc/group"
root:x:0:root
EOF
HOST_UID=`id --user` && HOST_GID=`id --group`
lxc-usernsexec -m u:0:$HOST_UID:1 -m g:0:$HOST_GID:1 -m u:1:$root_uid:1 -m g:1:$root_gid:1 -- chown --recursive 1:1 "$rootfs"
echo -e "Unprivileged container was created successfully.\n\nUseful commands:"
echo "Start the container: lxc-start --name=$NAME"
echo "Stop the container: lxc-stop --name=$NAME --timeout=1"
echo "Get a command prompt in running container: lxc-attach --name=$NAME"
echo "Follow the container’s log: tail --retry --follow=~/.local/share/lxc/$NAME/$NAME.log"
echo "request ip address for running container: lxc-attach --name=$NAME -- dhclient eth0"
echo "Get container ip addresses: lxc-info --name=$NAME --ips"
echo "Run a command inside the container (container should be stopped): lxc-execute --name=$NAME -- command args…"
brauner
stgraber
bijwaard
This would make lxc unprivileged containers easy.
This is the right thing to do.
Below is a bash script for Ubuntu that should be turned into a generic template
lxc unprivileged containers are awesome because they create a no-performance-penalty machine clone featuring hardware acceleration in about 80 KiB. The benefit to share the Linux system software is that the container does not need to be maintained or updated.
Isolation can be network, users, processes and file system.
Mysteriously, for unprivileged use as-installed, lxc does not actually offer this function but only the download template for heavier full Linux distributions. The lxc template support for unprivileged containers is very limited. It is unique for lxc to have no-proprietary-garbage, full machine capability and no root vulnerability. This should be supported well.
The below template provides the function at the expense of 80 KiB disk space. If one looks at the x11docker project, it could be extended with Wayland and secure per-application X server for safe accelerated isolation of graphical user interface applications.
Basically take the below script, rework it by looking at the download template, test it for other than Ubuntu like Gentoo, macOS and Windows, add X/Wayland, publish it as lxc-minimal or lxc-localhost
Ubuntu should use this isolation template for its app store just like Apple does with xhyve. It’s what is privacy and security on the desktop in 2017,