9 ms·
Linux containers in 500 lines of code
- unhammer 9y agooff-topic, but that's a pretty cool e-mail address she's got :-) I wonder how many clients fail on it.
- djsumdog 9y agoHuh. That is interesting. _ makes me think of a placeholder in Scala. It is a totally valid e-mail address .. makes me want to add it to my own domain and use it as a junk address.
- kkyn 9y agooff-topic, but that's a pretty cool e-mail address she's got :-)
- deleted 9y ago[deleted]
- kragniz 9y agoNice post! Plug for another container runtime, but in python: https://github.com/kragniz/omochabako https://github.com/kragniz/omochabako (although it doesn't do networking or cgroups) Writing this kind of stuff from scratch is good fun, and really helps understand the underlying kernel features.
- brooklynfoster 9y agowow lizzie sounds cool
- deleted 9y ago[deleted]
- gungoman 9y agoI bet lizzie is pretty hung.
- szemet 9y agoWhat a fine piece of literate programming! I've just printed it out, and it literally contains 100 page of explanation and context for that 500 lines of code. Great work!
- guardian5x 9y agoJust curious, why print it out?
- ourmandave 9y agoThe battery never dies on a paper copy. Also, there's no Amazon take backs.
- majewsky 9y agoAn HTML file on your local disk does not have Amazon take backs either.
- welly 9y agoA paper copy never survives an accidental home fire.
- cbernini 9y agoThat said, the owner might not survive as well. Anyways, I find reading on paper so much better than reading E-Ink as well, got a Kindle paperwhite, and it's out of battery somewhere because highlighting and note-taking (I do it a lot while studying) feels so much better with physical copies. Only reason for me to take the Kindle for a walk is when I'm traveling and weight is a concern.
- oblio 9y agoSome people like to read the dead-tree version. Nostalgia, maybe paper is better for the eyes, paper books are generally lighter than the equivalent sized tablets or ebooks, etc.
- jabl 9y agoYet another lightweight container runtime: bocker, docker reimplemented in about 100 lines of bash: https://github.com/p8952/bocker https://github.com/p8952/bocker
- solnyshko 9y agothat's a pretty cool e-mail address
- deleted 9y ago[deleted]
- vog 9y agoAre you the same person who wrote the other comments about the e-mail address? (both heavily downvoted, one flagged and disappeared). What do you want to achieve by repeating that ever and ever again?
- ktta 9y agoThere is some weird stuff going on with new accounts. Look around the bottom of recent threads. The new accounts copy a part of a comment in the same thread and repost it. Seems like someone is getting their feet wet in botting.
- joosters 9y agoThe root capabilities section is worrying. Instead of trying to exhaustively list every capability that needs to be dropped, shouldn't the code instead just list the capabilities that are allowed, and clear all the others? This would seem to better guard against accidentally missing existing capabilities, and also protect against newer capabilities that might be added in a future kernel.
- vog 9y agoI fully agree that whitelisting is safer than blacklisting. But on the top of the article, the author explicitly recognzied this and explained why they went down that route: > I wanted specifically to find a minimal set of restrictions to run untrusted code. This isn't how you should approach containers on anything with any exposure: you should restrict everything you can. But I think it's important to know which permissions are categorically unsafe!
- joosters 9y agoFair point. And the article does make a good read, with explanations about why each capability in particular should be disallowed.
- szemet 9y agoThat's true. I agree, you should iterate over all your existing capabilities and drop those that are not in the white-list. (I have implemented this functionality in one of my projects this way.) BUT: Maybe the reason some people do it otherwise, is that capabilities API have only a drop function for the bounding set, and people just don't think they should use it in reverse mode - Sapir-Whorf Hypothesis in operation! ;) edit: seems like the author have a different reason though
- awirth 9y agoDitto for the seccomp syscall (and args) blacklist, although I wouldn't describe it as "worrying" considering the disclaimer at the top. Jess Frazelle's contained.af uses a seccomp whitelist[1], which doesn't need to be that long to allow reasonable programs to execute. This is a very good piece of writing with extensive references and I'll definitely find this useful to share in the future. She documents a ton of tradeoffs she made and resources she chose not to constrain (including the aforementioned syscalls and capabilities), which is important in this type of design and something that I wish I saw more of. [1]: https://github.com/jessfraz/contained.af/blob/master/seccomp.go https://github.com/jessfraz/contained.af/blob/master/seccomp...
- zeveb 9y agoKinda cool how it's all generated from an org-mode file: https://blog.lizzie.io/linux-containers-in-500-loc.org https://blog.lizzie.io/linux-containers-in-500-loc.org Really nice example of the power of literate programming in general and of org-mode's support for it in particular.
- Bromskloss 9y agoShe mentions five Linux kernel mechanisms – "namespaces", "capabilities", "cgroups", and "setrlimit". Is any of those what I should use if I want to run an application inside some kind of container that lets me intercept file system calls (for example for the purpose of creating a file on the fly as it is accessed)?
- subway 9y agoNot really. You probably need to use FUSE or similar to pull something like that off.
- simcop2387 9y agoSeccomp with ptrace is the way I'd do this. You can setup the rules to signal the ptracing process to intercept the syscall. I've not done it before but it should be possible. Id also look at doing it in a mount namespace with overlayfs on top of everything the process can see, so that you can manipulate anything you want or need filewise without destroying the original system. Then you can copy out any changed files later if you want to preserve them.
- kylequest 9y agoYou should check out DockerSlim [0] then :-) It'll generate a seccomp profile for you and it uses ptrace too. [0] http://dockersl.im http://dockersl.im
- mzzter 9y agoI like to go to the first few commits of some repositories to see how the initial proof of concept was implemented. Docker was one that surprised me. Turns out that the core of it was mounting some folders with union fs and providing an API to track its location and status [1]. [1] https://github.com/moby/moby/blob/a27b4b8cb8e838d03a99b6d2b30f76bdaf2f9e5d/filesystem.go#L35 https://github.com/moby/moby/blob/a27b4b8cb8e838d03a99b6d2b3...
- davexunit 9y agoSince others are sharing lightweight container implementations, I'll throw mine in. This one is written in Scheme: http://git.savannah.gnu.org/cgit/guix.git/tree/gnu/build/linux-container.scm#n268 http://git.savannah.gnu.org/cgit/guix.git/tree/gnu/build/lin... I like to think that there are sufficient code comments and docstrings to help demystify what is going on under the hood with containers.
- Denzel 9y agoVery clean and easy to read, thanks for sharing. That code is amazingly illuminating.
- davexunit 9y agoThank you!
- rrhd 9y agoI'm reading it and I'm just wondering what this line means (eqv? #\1 (call-with-input-file userns-file read-char)) specifically the #\1?
- davexunit 9y ago#\ is the weird syntax for character objects in Guile, so #\1 is the character "1". This expression reads a single character from userns-file and checks if it is the character "1".
- dawkins 9y agowhat language is written in? It looks like lisp, but exceptionally readable.
- linux2647 9y agoScheme, according to the file extension, .scm
- edwintorok 9y agoIs it only me or both firefox and chromium refuse to connect with something like ERR_SSL_PROTOCOL_ERROR?