Ok so I'm using Docker and I'm not familiar w/ Chroot jail yet.
I have Docker image w/ installed Debian / Node.js. But I want that every single Debian user can run their own Node.js application w/o root access in Docker.
- user: jimmy
- home: /home/jimmy
- shell: /bin/bash
So jimmy now can run Node.js application because he has /bin/bash shell. But he can also modify whole system (he can do for example "rm -R /etc"). Am I right?
Then I can for example modify jimmy's shell: /usr/sbin/nologin and give him option to only start/stop Node.js instance from WEB UI... but in Node.js using "fs" module he can modify whole system. Am I right?
So now If I was right I have 2 options
- I think I can create "chroot jail" for jimmy. So /home/jimmy will be chroot jail. He can run his Node.js application and he can not modify whole system. Node.js "fs" will be restricted only for /home/jimmy. Am I right?
- Do not care and just init new Docker container for jimmy... This is great options but I think = new container = new system = more data [MBs]
Ok and If someone of you said first option is what I need. How then I can bind ports If jimmy will run Node.js web server with port 8080 and another user will use same port? With Docker I can handle this I guess before container start.