I want to build a lightweight process isolation tool built on linux features like namespaces and chroot (in order to understand them better).

I am currently running the following commands to start an isolated process:

sudo debootstrap --no-merged-usr stable /container/1 # get a root file system
unshare --mount --uts --ipc --net --fork --user --map-root-user /bin/bash
chroot /container/1 /bin/bash
unshare --pid --fork /bin/bash # Just to have PID=1
mount -t proc none /proc
mount -t sysfs none /sys
mount -t tmpfs none /tmp

As far as I can tell this isolates the /bin/bash process from all other processes and filesystems. The problem is that every file in the chroot environment (and beyond) is owned by nobody:nogroup, which means nothing works that includes changing files. In the root namespace the files are owned by the root user (from the debootstrap command).

My idea to fix this was to run the debootstrap command in the same user namespace as the final process. I got this result:

$ unshare --fork --user --map-root-user
# debootstrap stable /container/2
mknod: /home/mocc/test2/test-dev-null: Operation not permitted
E: Cannot install into target '/home/mocc/test2' mounted with noexec or nodev

Remounting the filesystem as mentioned in Cannot install into target mounted with noexec or nodev while doing qemu-deboot strapping didn't work.

Does someone know how to run debootstrap within a user namespace or another solution to the initial problem?

  • 1
    the unshare command is not designed to handle complex uid translations (it translates only current user to root with --map-root-user). So you'll need an other tool to handle this (eg lxc, or maybe newuidmap), along first a translation (using some manual script doing a lot of chown) of all the uid to an other range. See man subuid to get an idea. – A.B Dec 13 '18 at 23:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.