3 ms·

Ask HN: How does `lnav` run its playground which you can just SSH into?

https://lnav.org/ has a feature that single handedly sold me on trying out the fantastic software: An SSH-reachable playground. It's right there above the fold on the first page: ssh://playground@demo.lnav.org I want to build a similar playground for people who want to get familiar with the tools my Shell Bling Ubuntu repo provides ( https://github.com/hiAndrewQuinn/shell-bling-ubuntu ). Ideally it consists of a series of very simple tasks to get one's feet wet with each tool provided: Using fish's autocompletion, then using fzf's shell keybindings, then using rg instead of grep to search an enormous number of files for a single needle character in a million lines of wheat , and so on. I have no clue how to do this safely. I've never seen how anyone else does it either. Can anyone provide me some pointers?

rpgwaiter 3y ago
I would imagine the ssh server runs a command when someone connects that spins up a container that you're ultimately SSH-ing into. Doing this at any scale is interesting, maybe they put you in a lambda instance or something similar? lnav seems to lock you into their logfile program, which may add another layer of safety.
- hiAndrewQuinn 3y ago
  Ah, that makes a lot of sense. You can't do too much damage if you're inside of an ephemeral Docker container (at least that's the theory). I could do that and put people into a read only filesystem to minimize any chance of malicious breakouts. A MOTD can give them a first task to follow, which then leads to a breadcrumb tutorial strewn throughout the operating system.
jamessb 3y ago
It looks like they run an SSH server inside a Docker container defined by this Dockerfile [1]. This uses the ForceCommand directive in the sshd_config file to ensure that a specific command is run when a user connects (rather than the user connecting directly to a shell). Depending on whether the user connects as the `playground` or `tutorial1` user they interact with a bash script that is either [2] or [3]; these run lnav, using the timeout command to limit how long users are connected for, and to kill the lnav process if it gets stuck. [1]: https://github.com/tstack/lnav/blob/master/demo/Dockerfile https://github.com/tstack/lnav/blob/master/demo/Dockerfile [2]: https://github.com/tstack/lnav/blob/master/docs/tutorials/playground/run.sh https://github.com/tstack/lnav/blob/master/docs/tutorials/pl... [3]: https://github.com/tstack/lnav/blob/master/docs/tutorials/tutorial1/run.sh https://github.com/tstack/lnav/blob/master/docs/tutorials/tu...
- tstack 3y ago
  Yep, exactly this. I wrote a short blog post[1] announcing the playground, but didn't go into much detail. All this stuff just runs on the free-tier of fly.io since it doesn't get much traffic. [1] - https://lnav.org/2022/09/01/playground.html https://lnav.org/2022/09/01/playground.html
  - hiAndrewQuinn 3y ago
    Ah! I was about to write you an email to ask some further questions, but then I saw you replied here on HN. This is excellent, thanks for doing such a good job with your ChangeBlog.
- hiAndrewQuinn 3y ago
  Much appreciate the detective work you did on my behalf, James. I put the pieces together from the previous commenter but didn't get a chance to poke around the source code itself yesterday.

rpgwaiter 3y ago

I would imagine the ssh server runs a command when someone connects that spins up a container that you're ultimately SSH-ing into. Doing this at any scale is interesting, maybe they put you in a lambda instance or something similar? lnav seems to lock you into their logfile program, which may add another layer of safety.

hiAndrewQuinn 3y ago
Ah, that makes a lot of sense. You can't do too much damage if you're inside of an ephemeral Docker container (at least that's the theory). I could do that and put people into a read only filesystem to minimize any chance of malicious breakouts. A MOTD can give them a first task to follow, which then leads to a breadcrumb tutorial strewn throughout the operating system.

jamessb 3y ago

It looks like they run an SSH server inside a Docker container defined by this Dockerfile [1]. This uses the ForceCommand directive in the sshd_config file to ensure that a specific command is run when a user connects (rather than the user connecting directly to a shell). Depending on whether the user connects as the `playground` or `tutorial1` user they interact with a bash script that is either [2] or [3]; these run lnav, using the timeout command to limit how long users are connected for, and to kill the lnav process if it gets stuck. [1]: https://github.com/tstack/lnav/blob/master/demo/Dockerfile https://github.com/tstack/lnav/blob/master/demo/Dockerfile [2]: https://github.com/tstack/lnav/blob/master/docs/tutorials/playground/run.sh https://github.com/tstack/lnav/blob/master/docs/tutorials/pl... [3]: https://github.com/tstack/lnav/blob/master/docs/tutorials/tutorial1/run.sh https://github.com/tstack/lnav/blob/master/docs/tutorials/tu...

tstack 3y ago
Yep, exactly this. I wrote a short blog post[1] announcing the playground, but didn't go into much detail. All this stuff just runs on the free-tier of fly.io since it doesn't get much traffic. [1] - https://lnav.org/2022/09/01/playground.html https://lnav.org/2022/09/01/playground.html
- hiAndrewQuinn 3y ago
  Ah! I was about to write you an email to ask some further questions, but then I saw you replied here on HN. This is excellent, thanks for doing such a good job with your ChangeBlog.
hiAndrewQuinn 3y ago
Much appreciate the detective work you did on my behalf, James. I put the pieces together from the previous commenter but didn't get a chance to poke around the source code itself yesterday.