isomer/contain

Specify Linux process attributes

contain

A wrapper that lets you tweak Linux process options before you start a process. Kinda like a super version of nice(1). In particular this lets you create process namespaces and cgroups which lets you form up fairly usable containers.

Examples

• contain --ioidle=0 -- ls -R / Run ls in the background with the io priority set to idle. Using ioidle in this way is great for programs that read a lot of data (but not necessarily write a lot of data, see set_ioprio(2) for limitations)

• sudo contain --newnet -- bash Create a new networking namespace and run bash inside of it.

• Creating a new namespaces:

• sudo contain --newpid --newmount --mount /proc=none,proc -- ps aux

If you're going to create a new pid namespace, you probably also want to use "simple-init" (included) to act as the new pid 1, and clean up zombie processes.if this "init" process ever exits then the entire namespace is destroyed. Beware of this if you have a program that likes to daemonise itself as init.

• Using containers:

• First setup cgroups on this machine

• sudo mount -t tmpfs none /sys/fs/cgroup/

• sudo mkdir /sys/fs/cgroup/devices

• sudo mount -t cgroup -o devices devices /sys/fs/cgroup/devices

• Now demonstrate their use

• sudo contain --name "example-cgroup" \ --limit devices.deny=a \ --limit devices.allow="c 1:3 mr" \ -- cat /dev/null

• sudo contain --name "example-cgroup" \ --limit devices.deny=a \ --limit devices.allow="c 1:3 mr" \ -- cat /dev/zero This demonstrates a simple container that lets you specify which device nodes processes have access to. This denies access to all devices, but allows access to /dev/null. The two commands above demonstrate /dev/null working, but /dev/zero failing with operation not permitted.

• Using capabilities

  • sudo contain --cap=+net_bind_service -- su -c id This demonstrates disabling all capabilities except for binding to low ports. Multiple capabilities can be specified, separated by commas. Or you can instead list the capabilities you'd rather remove.

• Making root a non priviledged user sudo contain --noroot --uid=nobody -- su -c id This demonstrates that nobody can execute su, but the setuid bit doesn't grant it any extra privileges

• It's probably easier at this point to look at what mkcontain does with various example container files.