search

subuser-security / subuser

Run programs on linux with selectively restricted permissions.
http://subuser.org
GNU Lesser General Public License v3.0
890 stars 65 forks source link

Adding subuser to a docker compose project #327

Open CharlesJQuarra opened 7 years ago

CharlesJQuarra commented 7 years ago

Hi, I have a project with two docker images orchestrated with docker compose. I want to make one of the docker images use subuser to add seamless support for x11 into the container. I'm not sure what is the best way to proceed here, or if it is supported at all at this point

timthelion commented 7 years ago

Hi,

Docker compose is not supported. However, it is possible to use two contaniers together if you only need to share files/directories/unix sockets. However, it is not yet possible to link the network namespaces.

In order to share files/directories/unix sockets you can create two subusers and give them permission to access a shared directory by setting either the user-dirs or system-dirs permissions. http://subuser.org/subuser-standard/permissions-dot-json-file-format.html It is better to set the user-dirs perimission if you can get away with it, both because it will give the end user a better feeling on security, and also because it works on multi-user systems better.

To share a directory with the user-dirs permission, set that permission to say "user-dirs" : [".cache/my-shared-subuser-dir"]. You'll then have that dir shared in both subusers under /subuser/userdirs/.cache/my-shared-subuser-dir

You can then make symlinks to /subuser/userdirs/.cache/my-shared-subuser-dir in your Dockerfile (or SubuserImagefile) which point to the dir/file you actually want to share.

Note: I just realised that I have a bug in the userdirs code: https://github.com/subuser-security/subuser/issues/328

I'm off to fix that now.

On 07/27/2017 08:35 PM, CharlesJQuarra wrote:

Hi, I have a project with two docker images orchestrated with docker compose. I want to make one of the docker images use subuser to add seamless support for x11 into the container. I'm not sure what is the best way to proceed here, or if it is supported at all at this point

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/subuser-security/subuser/issues/327, or mute the thread https://github.com/notifications/unsubscribe-auth/ABU7-FoYoF-8b_t6LLVPgrvZIT04nSHMks5sSNiEgaJpZM4OlrNc.

timthelion commented 7 years ago

Working around #328 for the time being is a simple matter of pre-creating the directory.