Jail/Sandbox process on an overlay root and track changes

Question

What I am trying to achieve

I want to run a process as an unprivileged user, but all files that are changed by this process should be only changed in a shadow folder. Furthermore, I want to disable networking capabilities if needed.

What I have already tried

• mount overlay with lowerdir / and upperdir /temp/fakeroot, unshare -rn, chroot /temp/overlay
  • Problems: requires root for mount, overlay ignores nested mounts (my home directory)
• unshare -rmn, mount overlay with lowerdir / and upperdir /temp/fakeroot
  • Problems: error while trying to mount because /tmp is a subfolder of /
• fuse-overlayfs, unshare -rn, chroot
  • Problems: works only on kernels > 5.16, nested mounts can be read but writing is not possible
  • Note: I would be ok with the kernel limitation, but the nested mounts make it not usable

Alternatives that I know exist, but do not seem promising

• Overlayroot: needs to be mounted at startup and does not store change delta
• overlayroot-chroot: Based on above.
• mergefs for merging all file systems into one: can't see how this would be done
• using Docker: requires root, does not store change delta

Does anyone have an idea how to do that?

Answer 1

I found a solution combining multiple of the above-mentioned commands.

1. mkdir -p /tmp/overlay-test/{upper,workdir,mount}
2. unshare -- map-root-user --net --mount or short unshare -rnm
3. mount.mergerfs / /tmp/overlay-test/view -o use_ino,posix_acl=true (the options are optional)
4. mount -t overlay overlay -o lowerdir=/tmp/overlay-test/view,upperdir=/tmp/overlay-test/upper,workdir=/tmp/overlay-test/workdir /tmp/overlay-test/mount
5. mount --rbind /dev /tmp/overlay-test/mount/dev and mount --rbind /proc /tmp/overlay-test/mount/proc
6. chroot /tmp/overlay-test/mount /bin/bash

The general idea is to use unshare to create an environment where the user (not root) can mount a file system. Afterthat mergerfs is used to combine all sub-mounts (like home in many distros) into a single folder. This single folder can than be used as a lowerdir for the overlay. In order to execute commands, dev and proc need to be mapped into the overlay folder. This is ok as these folders are not writable by the user anyway. Last but not least, the chroot can be executed to switch to the overlayed-merged-rootfs. All changes made there are only done one the upper directory. When done, don't forget to unmount all mounts for cleanup.