{"action":"created","issue":{"url":"https://api.github.com/repos/lxc/lxc/issues/1796","repository_url":"https://api.github.com/repos/lxc/lxc","labels_url":"https://api.github.com/repos/lxc/lxc/issues/1796/labels{/name}","comments_url":"https://api.github.com/repos/lxc/lxc/issues/1796/comments","events_url":"https://api.github.com/repos/lxc/lxc/issues/1796/events","html_url":"https://github.com/lxc/lxc/issues/1796","id":255665294,"number":1796,"title":"Create minimal template for lightweight application isolation","user":{"login":"haraldrudell","id":926815,"avatar_url":"https://avatars2.githubusercontent.com/u/926815?v=4","gravatar_id":"","url":"https://api.github.com/users/haraldrudell","html_url":"https://github.com/haraldrudell","followers_url":"https://api.github.com/users/haraldrudell/followers","following_url":"https://api.github.com/users/haraldrudell/following{/other_user}","gists_url":"https://api.github.com/users/haraldrudell/gists{/gist_id}","starred_url":"https://api.github.com/users/haraldrudell/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/haraldrudell/subscriptions","organizations_url":"https://api.github.com/users/haraldrudell/orgs","repos_url":"https://api.github.com/users/haraldrudell/repos","events_url":"https://api.github.com/users/haraldrudell/events{/privacy}","received_events_url":"https://api.github.com/users/haraldrudell/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2017-09-06T16:25:42Z","updated_at":"2017-10-06T18:11:17Z","closed_at":null,"author_association":"NONE","body":"This would make lxc unprivileged containers easy.\r\n\r\nThis is the right thing to do.\r\n\r\nBelow is a bash script for Ubuntu that should be turned into a generic template\r\n\r\nlxc unprivileged containers are awesome because they create a no-performance-penalty machine clone featuring hardware acceleration in about 80 KiB. The benefit to share the Linux system software is that the container does not need to be maintained or updated.\r\n\r\nIsolation can be network, users, processes and file system.\r\n\r\nMysteriously, for unprivileged use as-installed, lxc does not actually offer this function but only the download template for heavier full Linux distributions. The lxc template support for unprivileged containers is very limited. It is unique for lxc to have no-proprietary-garbage, full machine capability and no root vulnerability. This should be supported well.\r\n\r\nThe below template provides the function at the expense of 80 KiB disk space. If one looks at the x11docker project, it could be extended with Wayland and secure per-application X server for safe accelerated isolation of graphical user interface applications.\r\n\r\nBasically take the below script, rework it by looking at the download template, test it for other than Ubuntu like Gentoo, macOS and Windows, add X/Wayland, publish it as lxc-minimal or lxc-localhost\r\n\r\nUbuntu should use this isolation template for its app store just like Apple does with xhyve. It’s what is privacy and security on the desktop in 2017,\r\n\r\n```bash\r\n#!/bin/bash -eu\r\n# © 2017 Harald Rudell <harald.rudell@gmail.com> (http://haraldrudell.com) ISC License.\r\nwhile [ $# -ge 1 ]; do case \"$1\" in\r\n  --help) echo \"lxc-unpriv [--name=name]\"; exit;;\r\n  --name=*) NAME=\"${1#*=}\";;\r\n  *) echo >&2 \"unknown options: '$*' usage: lxc-unpriv [--name=name]\"; exit 2;;\r\nesac; shift; done\r\nif [ ! \"${NAME-}\" ]; then NAME=`hostname --short`-`date --utc +%y%m%d-%H%M%S`; fi\r\necho \"Creating unprivileged container $NAME …\"\r\nconfig=~/\".local/share/lxc/$NAME/config\"\r\nlxc-create --template=none --name=\"$NAME\"\r\nif [ ! -s \"$config\" ]; then echo >2 \"Container configuration file missing: '$config'\"; exit 1; fi\r\necho \"Container configuration file: $config\"\r\nsed --in-place \"1i# Container created on: `date --utc +%y%m%d-%H%M%S` by lxc-unpriv © 2017 Harald Rudell <harald.rudell@gmail.com> (http://haraldrudell.com) ISC License.\\n# lxc-unpriv: `stat --format=%y \"$0\"` sha256: `sha256sum \"$0\" | cut --delimiter=\" \" --field=1`\" \"$config\"\r\nroot_uid=\"`sed --silent 's/^\\s*lxc.id_map\\s*=\\s*u\\s*0\\s*\\([0-9]\\+\\).*/\\1/p' \"$config\"`\"\r\nroot_gid=\"`sed --silent 's/^\\s*lxc.id_map\\s*=\\s*g\\s*0\\s*\\([0-9]\\+\\).*/\\1/p' \"$config\"`\"\r\n[ \"$root_uid\" -gt 0 ] && [ \"$root_gid\" -gt 0 ] || { echo >&2 \"Failed to parse lxc.id_map in config file '$config'\"; exit 1; }echo \"Container root group and user mapped to host: $root_uid:$root_gid\"\r\nrootfs=~/\".local/share/lxc/$NAME/rootfs\"\r\nmkdir --parents \\\r\n\"$rootfs/bin\" \\\r\n\"$rootfs/etc/init.d\" \\\r\n\"$rootfs/etc/rc.d\" \\\r\n\"$rootfs/etc/sysconfig/network-scripts\" \\\r\n\"$rootfs/home\" \\\r\n\"$rootfs/lib\" \\\r\n\"$rootfs/lib64\" \\\r\n\"$rootfs/proc\" \\\r\n\"$rootfs/root\" \\\r\n\"$rootfs/sbin\" \\\r\n\"$rootfs/sys\" \\\r\n\"$rootfs/tmp\" \\\r\n\"$rootfs/usr\" \\\r\n\"$rootfs/var\"\r\ntouch \"$rootfs/etc/fstab\"\r\ngrep --quiet \"^lxc.network.ipv4\" \"$config\" || echo \"send host-name = gethostname();\" >\"$rootfs/dhclient.conf\"\r\nln --symbolic \"$rootfs/run\" \"$rootfs/var/run\"\r\ncat <<EOF >\"$rootfs/etc/passwd\"\r\nroot:x:0:0:root:/root:/bin/bash\r\nEOF\r\ncat <<EOF >\"$rootfs/etc/group\"\r\nroot:x:0:root\r\nEOF\r\ncat <<EOF >>\"$config\"\r\nlxc.include = /usr/share/lxc/config/ubuntu.common.conf\r\nlxc.include = /usr/share/lxc/config/ubuntu.userns.conf\r\nlxc.rootfs = $rootfs\r\nlxc.utsname = $NAME\r\nlxc.pts = 1024\r\nlxc.cap.drop = sys_module mac_admin mac_override sys_time\r\nlxc.aa_profile = unconfined\r\nlxc.mount.entry = /bin bin none ro,bind 0 0\r\nlxc.mount.entry = /etc/init.d etc/init.d none ro,bind 0 0\r\nlxc.mount.entry = /lib lib none ro,bind 0 0\r\nlxc.mount.entry = /sbin sbin none ro,bind 0 0\r\nlxc.mount.entry = /usr usr none ro,bind 0 0\r\nlxc.mount.auto = cgroup:mixed proc:mixed sys:mixed\r\nEOF\r\nif [ -d /etc/sysconfig/network-scripts ]; then cat <<EOF >>\"$config\"\r\nlxc.mount.entry = /etc/sysconfig/network-scripts etc/sysconfig/network-scripts none ro,bind 0 0\r\nEOF\r\nfi\r\nif [ -d /etc/rc.d ]; then cat <<EOF >>\"$config\"\r\nlxc.mount.entry = /etc/rc.d etc/rc.d none ro,bind 0 0\r\nEOF\r\nfi\r\nif [ \"$(uname --machine)\" = x86_64 ]; then cat <<EOF >>\"$config\"\r\nlxc.mount.entry = /lib64 lib64 none ro,bind 0 0\r\nlxc.arch = x86_64\r\nEOF\r\nfi\r\nCMD=(sudo chown --recursive $root_uid:$root_gid \"$rootfs\")\r\necho -e \"\\nMust change ownership of the root file system to container’s root user: $root_uid:$root_gid\"\r\necho \"Elevated privileges are required to execute: ${CMD[*]}\"\r\n\"${CMD[@]}\"\r\necho -e \"Unprivileged container was created successfully.\\n\\nUseful commands:\"\r\necho \"Start the container: lxc-start --name=$NAME\"\r\necho \"Stop the container: lxc-stop --name=$NAME --timeout=1\"\r\necho \"Get a command prompt in running container: lxc-attach --name=$NAME\"\r\necho \"Follow the container’s log: tail --retry --follow=~/.local/share/lxc/$NAME/$NAME.log\"\r\necho \"request ip address for running container: lxc-attach --name=$NAME -- dhclient eth0\"\r\necho \"Get container ip addresses: lxc-info --name=$NAME --ips\"\r\necho \"Run a command inside the container (container should be stopped): lxc-execute --name=$NAME -- command args…\"\r\n\r\n```"},"comment":{"url":"https://api.github.com/repos/lxc/lxc/issues/comments/334830469","html_url":"https://github.com/lxc/lxc/issues/1796#issuecomment-334830469","issue_url":"https://api.github.com/repos/lxc/lxc/issues/1796","id":334830469,"user":{"login":"brauner","id":7353573,"avatar_url":"https://avatars0.githubusercontent.com/u/7353573?v=4","gravatar_id":"","url":"https://api.github.com/users/brauner","html_url":"https://github.com/brauner","followers_url":"https://api.github.com/users/brauner/followers","following_url":"https://api.github.com/users/brauner/following{/other_user}","gists_url":"https://api.github.com/users/brauner/gists{/gist_id}","starred_url":"https://api.github.com/users/brauner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brauner/subscriptions","organizations_url":"https://api.github.com/users/brauner/orgs","repos_url":"https://api.github.com/users/brauner/repos","events_url":"https://api.github.com/users/brauner/events{/privacy}","received_events_url":"https://api.github.com/users/brauner/received_events","type":"User","site_admin":false},"created_at":"2017-10-06T18:11:17Z","updated_at":"2017-10-06T18:11:17Z","author_association":"MEMBER","body":"If you to start a proper discussion around this template and it isn't too much work for you and you can deal with a potential \"no\" you could send a pr that properly integrates this. But @stgraber might already have an opinion on this. :)"}}
{"actor":{"display_login":"brauner"}}