5 ms·

Subuser: Docker as Desktop Programs

87 points by backing 6y ago

tubbyjr 6y ago
I really like the premise, and already use containers as ingredient in my isolation techniques, however, subuser development didn't seem particularly active, is it just because it's considered in a feature complete state?
- backing 6y ago
  Yes it's still working fine, no docker change did break it yet. The main repo is an image base for examples and base for developers to create their own images. It has been updated in june 20, the main base file is debian buster. All other image files are based on this one and a simple update does actually upgrade your tools from the older base image to the newer one - It's like symlinked Dockerfiles.
ubercow13 6y ago
Flatpak and snapd seem to have some similar goals but aren't mentioned in the related projects section? I would have thought it would now be more performant to do something like this using Wayland and, if the app uses X11, multiple isolated xwayland instances somehow. That way you might be able to get GPU acceleration, which I don’t think is possible through xpra?
- williamstein 6y ago
  I wonder if there is anything like this that is cross platform (e.g., Windows, Linux, MacOS), probably building on what Docker provides? - Subuser - Securing the Linux desktop with Docker - Flatpak - The Future of Apps on Linux - snapd - Snap is a software packaging and deployment system developed by Canonical for the operating systems that use the Linux kernel.
  - ori_b 6y ago
    Docker on Mac or Windows is a Linux VM. It's not magically portable.
    - lostmsu 6y ago
      As long as it works, does it matter?
      - bauerd 6y ago
        Yes, because you get the performance overhead of a VM Containers are good old userspace processes in comparison scheduled by the kernel you already run
      - ori_b 6y ago
        You can also run flatpak in a linux vm, and use X11 to see it in Windows, so how is this different?
    - mattlondon 6y ago
      Is that still true for WSL2?
      - ori_b 6y ago
        WSL1 was not a VM. WSL2 is a VM.
    - dastx 6y ago
      Windows based containers do exist. Docker for Windows can run both Linux (a VM) and Windows applications. If I'm not mistaken, both are implemented via HyperV.
jbergknoff 6y ago
I'm a big fan of using containers to distribute and run tools. It's an underappreciated use case. I wrote about its benefits (and drawbacks) a few months ago: https://jonathan.bergknoff.com/journal/run-more-stuff-in-docker/ https://jonathan.bergknoff.com/journal/run-more-stuff-in-doc.... Subuser looks interesting, nice work! I love to see progress in this space.
- kreetx 6y ago
  How does lxd fit into this space - similar to docker it's also based on cgroups and namespaces?
  - adamnew123456 6y ago
    More or less, though LXC (and LXD using the LXC backend) are focused on system containers rather than single services. Basically lightweight VMs with a full init and the usual set of set of system daemons.
storrgie 6y ago
Toolbox on silverblue is something to look at if you're interested in this style of application deployment.
tablebookchair 6y ago
This is awesome, thanks for sharing! The problem at hand is actually a pet peeve of mine and I really don't get why it's still the default to grant programs access to all our personal data. There is a lot wrong with mobile OSs, but in this regard they are actually ahead of the curve.
- dastx 6y ago
  > The problem at hand is actually a pet peeve of mine and I really don't get why it's still the default to grant programs access to all our personal data. That's because our data has become a commodity relatively recently, and desktop technology still hasn't fully caught up yet. Regardless, it seems in general it's companies that run web services that are a bigger problem than desktop applications. Either way, I'm glad projects like these exist, including snapd, flatpak, and this. The likes of flatpak and snapd may not be perfect, but it's progress.
  - backing 6y ago
    I've heard here on HN that the problem with Snap is that it doesn't enforce restrictions, and that most used programs on snap ask for all permissions, including access to all of your files. I think you can check it in the snap metadata.
    - deleted 6y ago
      [deleted]
- djeiasbsbo 6y ago
  I run into this daily with programs packaged as flatpaks. Almost all of them can access the entire home directory. This can be changed with the flatpak-override command or the graphical software Flatseal.
- backing 6y ago
  You're welcome. I found this on stackoverflow and gosh it's from 2015! I was about to just use a plain docker for firefox and slack with mounted X11 file. This project tought me about a more secure method for X11 forward.
dastx 6y ago
This seems really interesting. A somewhat related project is x11docker[0] which attempts to make it easier to run gui applications through docker. It works pretty well with docker, though I've not used it since I switched to podman as there wasn't any support for it at the time. I've not tried recently. It does seem this project is at a dead end based on the recent development activity in recent months. [0] https://github.com/mviereck/x11docker/ https://github.com/mviereck/x11docker/
thom 6y ago
Ah good, was worried these performance gains from recent CPU advances might create unreasonable user expectations.
- speedgoose 6y ago
  It has always been like this, computers become faster which allow us to do more software abstractions.
  - jblow 6y ago
    Okay, but ... what is being gained here? The ability to package programs so they run on a computer without you worrying about it? That is an ability we had since the 1960s, that people gave up for "reasons" that are questionable at best. Someday people will realize they don't have to make their computers orders of magnitude slower just in order to get back capabilities that used to come automatically. But that day is not today, I guess.
    - pixl97 6y ago
      >The ability to package programs so they run on a computer without you worrying about it? Have we forgot about DLL hell and the myriad of security problems we've experienced since then?
- sneak 6y ago
  Apps in linux containers run at the same speed as any other app running on that system. This comment is pure snark.
  - backing 6y ago
    Exactly, the same usage for cpu and astonishingly also for memory. It's no virtual machine but a contained program that doesn't access your host system. Even X11 forward is secure with Xpra X11 bridge.
superkuh 6y ago
All these containerization "solutions" are just the fever symptoms of the future shock from the extremely rapid rate of features and improvement in the underlying libraries (glibc, c++?, etc) used by programmers, and the programmer's tendency to use those fancy new features asap. It makes compiling, or even running, something written today on the dev environment of a 5 year old linux distro pretty darn difficult and worse with time. They are a terrible idea for the desktop or academia. They're fine for server environments.
shuringai 6y ago
systemd-run -p DynamicUser=true <yourcommand>
- eikenberry 6y ago
  https://www.redhat.com/sysadmin/systemd-secure-services https://www.redhat.com/sysadmin/systemd-secure-services
zby 6y ago
If the point is security - then it should be virtual machines not containers. I wish QubesOS was more popular.
- backing 6y ago
  It depends on the hardware and usage. For older computers, virtual machines are too demanding. As for escalation hacks: they happen also on virtual machines. Check virtualbox and vmware cve's.
skissane 6y ago
Their "subuser standard" has the following license [1]: > Creative Commons Zero, public domain > With the following exception: > Only standards documents identical to those released by Timothy V Hobbs(timthelion) or another person or party whom he nominates may be presented as defining “the subuser standard”. In other words: you cannot edit this document and then claim that your new standard is the official one. That's legally incoherent. You cannot have public domain with an exception. Either something is in the public domain (no copyright) or it is not (copyrighted). If it is copyrighted, then you can license it under "X with the following exception". Most commonly, those exceptions grant extra rights compared to the base license (e.g. Classpath exception), occasionally they aim to take away rights compared to the base license (e.g. the notorious "Commons Clause"). But you can only have an exception to a copyright license if there is a copyright to be licensed, and putting something in the public domain means there isn't. CC0 is a bit of a hybrid in that it contains both a public domain dedication for those jurisdictions which recognise that, and a permissive fallback copyright license for those jurisdictions that don't (e.g. Germany). The author claiming to make an exception to CC0, it makes sense for the later but not for the former. Does this mean the exception is only legally binding in the jurisdictions in which the fallback license applies? Or does the attempt to impose an exception nullify the public domain dedication? I don't know, IANAL. (But I imagine many lawyers won't know the answer either.) Now, what the author aims to do here could be achieved by trademark law – claiming (or registering) "subuser standard" as a trademark, and then saying that even though the copyright of the standard is relinquished to the public domain, the trademark is only licensed under certain conditions. But while that would legally make sense, it isn't what the author has actually done. https://subuser.org/subuser-standard/standard.html#subuser-standard-licence https://subuser.org/subuser-standard/standard.html#subuser-s...
jasonpeacock 6y ago
Whalebrew[0] has been doing this for years, though Subuser appears to provide more configuration/access control. [0] https://github.com/whalebrew/whalebrew https://github.com/whalebrew/whalebrew It's not a new nor crazy idea...Jessie (jessfraz.com) talked about doing this[1] in their desktop environment back in 2015. https://blog.jessfraz.com/post/docker-containers-on-the-desktop/ https://blog.jessfraz.com/post/docker-containers-on-the-desk...

87 points by backing 6y ago

I really like the premise, and already use containers as ingredient in my isolation techniques, however, subuser development didn't seem particularly active, is it just because it's considered in a feature complete state?

backing 6y ago
Yes it's still working fine, no docker change did break it yet. The main repo is an image base for examples and base for developers to create their own images. It has been updated in june 20, the main base file is debian buster. All other image files are based on this one and a simple update does actually upgrade your tools from the older base image to the newer one - It's like symlinked Dockerfiles.

ubercow13 6y ago

Flatpak and snapd seem to have some similar goals but aren't mentioned in the related projects section? I would have thought it would now be more performant to do something like this using Wayland and, if the app uses X11, multiple isolated xwayland instances somehow. That way you might be able to get GPU acceleration, which I don’t think is possible through xpra?

williamstein 6y ago
I wonder if there is anything like this that is cross platform (e.g., Windows, Linux, MacOS), probably building on what Docker provides? - Subuser - Securing the Linux desktop with Docker - Flatpak - The Future of Apps on Linux - snapd - Snap is a software packaging and deployment system developed by Canonical for the operating systems that use the Linux kernel.
- ori_b 6y ago
  Docker on Mac or Windows is a Linux VM. It's not magically portable.
  - lostmsu 6y ago
    As long as it works, does it matter?
    - bauerd 6y ago
      Yes, because you get the performance overhead of a VM Containers are good old userspace processes in comparison scheduled by the kernel you already run
    - ori_b 6y ago
      You can also run flatpak in a linux vm, and use X11 to see it in Windows, so how is this different?
  - mattlondon 6y ago
    Is that still true for WSL2?
    - ori_b 6y ago
      WSL1 was not a VM. WSL2 is a VM.
  - dastx 6y ago
    Windows based containers do exist. Docker for Windows can run both Linux (a VM) and Windows applications. If I'm not mistaken, both are implemented via HyperV.

jbergknoff 6y ago

I'm a big fan of using containers to distribute and run tools. It's an underappreciated use case. I wrote about its benefits (and drawbacks) a few months ago: https://jonathan.bergknoff.com/journal/run-more-stuff-in-docker/ https://jonathan.bergknoff.com/journal/run-more-stuff-in-doc.... Subuser looks interesting, nice work! I love to see progress in this space.

kreetx 6y ago
How does lxd fit into this space - similar to docker it's also based on cgroups and namespaces?
- adamnew123456 6y ago
  More or less, though LXC (and LXD using the LXC backend) are focused on system containers rather than single services. Basically lightweight VMs with a full init and the usual set of set of system daemons.

storrgie 6y ago

Toolbox on silverblue is something to look at if you're interested in this style of application deployment.

tablebookchair 6y ago

This is awesome, thanks for sharing! The problem at hand is actually a pet peeve of mine and I really don't get why it's still the default to grant programs access to all our personal data. There is a lot wrong with mobile OSs, but in this regard they are actually ahead of the curve.

dastx 6y ago
> The problem at hand is actually a pet peeve of mine and I really don't get why it's still the default to grant programs access to all our personal data. That's because our data has become a commodity relatively recently, and desktop technology still hasn't fully caught up yet. Regardless, it seems in general it's companies that run web services that are a bigger problem than desktop applications. Either way, I'm glad projects like these exist, including snapd, flatpak, and this. The likes of flatpak and snapd may not be perfect, but it's progress.
- backing 6y ago
  I've heard here on HN that the problem with Snap is that it doesn't enforce restrictions, and that most used programs on snap ask for all permissions, including access to all of your files. I think you can check it in the snap metadata.
  - deleted 6y ago
    [deleted]
djeiasbsbo 6y ago
I run into this daily with programs packaged as flatpaks. Almost all of them can access the entire home directory. This can be changed with the flatpak-override command or the graphical software Flatseal.
backing 6y ago
You're welcome. I found this on stackoverflow and gosh it's from 2015! I was about to just use a plain docker for firefox and slack with mounted X11 file. This project tought me about a more secure method for X11 forward.

dastx 6y ago

This seems really interesting. A somewhat related project is x11docker[0] which attempts to make it easier to run gui applications through docker. It works pretty well with docker, though I've not used it since I switched to podman as there wasn't any support for it at the time. I've not tried recently. It does seem this project is at a dead end based on the recent development activity in recent months. [0] https://github.com/mviereck/x11docker/ https://github.com/mviereck/x11docker/

thom 6y ago

Ah good, was worried these performance gains from recent CPU advances might create unreasonable user expectations.

speedgoose 6y ago
It has always been like this, computers become faster which allow us to do more software abstractions.
- jblow 6y ago
  Okay, but ... what is being gained here? The ability to package programs so they run on a computer without you worrying about it? That is an ability we had since the 1960s, that people gave up for "reasons" that are questionable at best. Someday people will realize they don't have to make their computers orders of magnitude slower just in order to get back capabilities that used to come automatically. But that day is not today, I guess.
  - pixl97 6y ago
    >The ability to package programs so they run on a computer without you worrying about it? Have we forgot about DLL hell and the myriad of security problems we've experienced since then?
sneak 6y ago
Apps in linux containers run at the same speed as any other app running on that system. This comment is pure snark.
- backing 6y ago
  Exactly, the same usage for cpu and astonishingly also for memory. It's no virtual machine but a contained program that doesn't access your host system. Even X11 forward is secure with Xpra X11 bridge.

superkuh 6y ago

All these containerization "solutions" are just the fever symptoms of the future shock from the extremely rapid rate of features and improvement in the underlying libraries (glibc, c++?, etc) used by programmers, and the programmer's tendency to use those fancy new features asap. It makes compiling, or even running, something written today on the dev environment of a 5 year old linux distro pretty darn difficult and worse with time. They are a terrible idea for the desktop or academia. They're fine for server environments.

shuringai 6y ago

systemd-run -p DynamicUser=true <yourcommand>

eikenberry 6y ago
https://www.redhat.com/sysadmin/systemd-secure-services https://www.redhat.com/sysadmin/systemd-secure-services

zby 6y ago

If the point is security - then it should be virtual machines not containers. I wish QubesOS was more popular.

backing 6y ago
It depends on the hardware and usage. For older computers, virtual machines are too demanding. As for escalation hacks: they happen also on virtual machines. Check virtualbox and vmware cve's.

skissane 6y ago

Their "subuser standard" has the following license [1]: > Creative Commons Zero, public domain > With the following exception: > Only standards documents identical to those released by Timothy V Hobbs(timthelion) or another person or party whom he nominates may be presented as defining “the subuser standard”. In other words: you cannot edit this document and then claim that your new standard is the official one. That's legally incoherent. You cannot have public domain with an exception. Either something is in the public domain (no copyright) or it is not (copyrighted). If it is copyrighted, then you can license it under "X with the following exception". Most commonly, those exceptions grant extra rights compared to the base license (e.g. Classpath exception), occasionally they aim to take away rights compared to the base license (e.g. the notorious "Commons Clause"). But you can only have an exception to a copyright license if there is a copyright to be licensed, and putting something in the public domain means there isn't. CC0 is a bit of a hybrid in that it contains both a public domain dedication for those jurisdictions which recognise that, and a permissive fallback copyright license for those jurisdictions that don't (e.g. Germany). The author claiming to make an exception to CC0, it makes sense for the later but not for the former. Does this mean the exception is only legally binding in the jurisdictions in which the fallback license applies? Or does the attempt to impose an exception nullify the public domain dedication? I don't know, IANAL. (But I imagine many lawyers won't know the answer either.) Now, what the author aims to do here could be achieved by trademark law – claiming (or registering) "subuser standard" as a trademark, and then saying that even though the copyright of the standard is relinquished to the public domain, the trademark is only licensed under certain conditions. But while that would legally make sense, it isn't what the author has actually done. https://subuser.org/subuser-standard/standard.html#subuser-standard-licence https://subuser.org/subuser-standard/standard.html#subuser-s...

jasonpeacock 6y ago

Whalebrew[0] has been doing this for years, though Subuser appears to provide more configuration/access control. [0] https://github.com/whalebrew/whalebrew https://github.com/whalebrew/whalebrew It's not a new nor crazy idea...Jessie (jessfraz.com) talked about doing this[1] in their desktop environment back in 2015. https://blog.jessfraz.com/post/docker-containers-on-the-desktop/ https://blog.jessfraz.com/post/docker-containers-on-the-desk...