How to automatically launch a lxc container on ssh connection?

Question

I'm attempting to setup a system that automatically creates a new sandbox on a ssh login to use as a temporary jump box into my server. So to do this I was wonder how to setup lxc to spin up a new shell in the container once there is a ssh connection then destroy that container after the session is closed.

What would be the best way to go about this?

EDIT:

Thanks to everyone that has placed their input. I have been able to devise the method to do this same setup as follows:

/etc/ssh/sshd_config:

match group ssh forceCommand sudo docker run --rm -t -i busybox /bin/sh

What this does is forces the user session to instantly go into a busybox container then delete the changes on exit. One could change or create their own image and specify this in place of busybox. Though this is included here since the only thing the default busybox container offers is wget and telnet which is good enough for most OOB testing/jump-boxes and this was the use case goal with this design.

Answer 1

Okay, your main problem doesn't appear to be the way you execute this. That's relatively easy with ForceCommand inside a Match block of sshd_config.

In order to do what you want to achieve, i.e. a throw-away container that "self-destructs" after use, you can use lxc-start-ephemeral. That's to say your use-case has already been considered in the set of LXC userspace tools. Only catch: your LXC version needs to be recent enough.

There's one more thing. You need a container which lxc-start-ephemeral uses as the basis for the ephemeral clone to start. More details can be found in on the man page for lxc-start-ephemeral.