I want to build a lightweight process isolation tool built on linux features like namespaces and chroot (in order to understand them better).
I am currently running the following commands to start an isolated process:
sudo debootstrap --no-merged-usr stable /container/1 # get a root file system unshare --mount --uts --ipc --net --fork --user --map-root-user /bin/bash chroot /container/1 /bin/bash unshare --pid --fork /bin/bash # Just to have PID=1 mount -t proc none /proc mount -t sysfs none /sys mount -t tmpfs none /tmp
As far as I can tell this isolates the
/bin/bash process from all other processes and filesystems. The problem is that every file in the chroot environment (and beyond) is owned by
nobody:nogroup, which means nothing works that includes changing files.
In the root namespace the files are owned by the
root user (from the
My idea to fix this was to run the
debootstrap command in the same user namespace as the final process. I got this result:
$ unshare --fork --user --map-root-user # debootstrap stable /container/2 mknod: /home/mocc/test2/test-dev-null: Operation not permitted E: Cannot install into target '/home/mocc/test2' mounted with noexec or nodev
Remounting the filesystem as mentioned in Cannot install into target mounted with noexec or nodev while doing qemu-deboot strapping didn't work.
Does someone know how to run debootstrap within a user namespace or another solution to the initial problem?