7 ms·
She mentions five Linux kernel mechanisms – "namespaces", "capabilities", "cgroups", and "setrlimit". Is any of those what I should use if I want to run an appl
by Bromskloss 9y ago
She mentions five Linux kernel mechanisms – "namespaces", "capabilities", "cgroups", and "setrlimit". Is any of those what I should use if I want to run an application inside some kind of container that lets me intercept file system calls (for example for the purpose of creating a file on the fly as it is accessed)?
- subway 9y agoNot really. You probably need to use FUSE or similar to pull something like that off.
- simcop2387 9y agoSeccomp with ptrace is the way I'd do this. You can setup the rules to signal the ptracing process to intercept the syscall. I've not done it before but it should be possible. Id also look at doing it in a mount namespace with overlayfs on top of everything the process can see, so that you can manipulate anything you want or need filewise without destroying the original system. Then you can copy out any changed files later if you want to preserve them.
- kylequest 9y agoYou should check out DockerSlim [0] then :-) It'll generate a seccomp profile for you and it uses ptrace too. [0] http://dockersl.im http://dockersl.im