I'm attempting to setup a system that automatically creates a new sandbox on a ssh login to use as a temporary jump box into my server. So to do this I was wonder how to setup lxc to spin up a new shell in the container once there is a ssh connection then destroy that container after the session is closed.

What would be the best way to go about this?


Thanks to everyone that has placed their input. I have been able to devise the method to do this same setup as follows:


match group ssh forceCommand sudo docker run --rm -t -i busybox /bin/sh

What this does is forces the user session to instantly go into a busybox container then delete the changes on exit. One could change or create their own image and specify this in place of busybox. Though this is included here since the only thing the default busybox container offers is wget and telnet which is good enough for most OOB testing/jump-boxes and this was the use case goal with this design.

  • ssh user@host lxc-create -f $CONTAINER_CONFIGPATH -n $CONTAINER_NAME
    – mikeserv
    Mar 23, 2014 at 6:23
  • Thats probably not the best way. You should be able insert commands in your ssh key, though. Probably thats the best way.
    – mikeserv
    Mar 23, 2014 at 6:27
  • OK so adding ForceCommand lxc-create -f $container_configpath -n jailshel to the /etc/ssh/sshd_config is a given but how does this destroy the container when the ssh session is closed? Mar 23, 2014 at 7:15
  • 2
    Ok. I get it. You're not who you're trying to jail. Sorry. ForceCommand sh -i ( readonly con='-n jailshel'; trap 'lxc-destroy $con' EXIT $andtherest ; lxc-create -f $container_configpath $con ) or something. Run it as a child of some process that will exit when a connection quits and execute lxc-destroy in a trap.
    – mikeserv
    Mar 23, 2014 at 7:41
  • 1
    does it work? Dont have any containers configured and didnt test... Dont like to put untested stuff into answers...
    – mikeserv
    Mar 23, 2014 at 7:54

1 Answer 1


Okay, your main problem doesn't appear to be the way you execute this. That's relatively easy with ForceCommand inside a Match block of sshd_config.

In order to do what you want to achieve, i.e. a throw-away container that "self-destructs" after use, you can use lxc-start-ephemeral. That's to say your use-case has already been considered in the set of LXC userspace tools. Only catch: your LXC version needs to be recent enough.

There's one more thing. You need a container which lxc-start-ephemeral uses as the basis for the ephemeral clone to start. More details can be found in on the man page for lxc-start-ephemeral.

  • That would work but you still need to issue a lxc connect right afterwards there for leaving a race condition. Though I have read up a bit more and think a better solution is to use Docker. May 5, 2014 at 5:22
  • For throwaway containers, I'd argue docker is better indeed. Why would you need a "connect" though? Wouldn't it be sufficient to give access to the "console" of the container, which the start command should automagically do?! May 5, 2014 at 9:22
  • Thanks, sorry about that I did ment console. Guess I was thinking about qemu for a moment there. May 5, 2014 at 22:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .