Systemd lightweight containers [LWN.net]

Systemd lightweight containers

Posted Feb 7, 2013 9:58 UTC (Thu) by mezcalero (subscriber, #45103)
In reply to: Systemd lightweight containers by bgmarete
Parent article: Systemd lightweight containers

It's not as bad as it sounds, as in most cases the root inside the container won't see much of the host's resources and hence can't do much bad on it. It also lacks many capabilities, so that it is anyway much less powerful than a real root. And then, the per-user settings the kernel maintains for root generally don't have much effect anyway, such as RLIMIT_NPROC.

I also doubt that UID namespaces are really a magic bullet. Their support in file systems is really awkward (if you processes has multiple UIDs, but your file system only maintains one per file, how could that ever work?), so I kinda get the impression they create more problems than they solve.

I am not convinced that I'll ever update nspawn to make use of UID namespaces.

to post comments

Systemd lightweight containers

Posted Feb 7, 2013 11:58 UTC (Thu) by Cyberax (✭ supporter ✭, #52523) [Link] (2 responses)

Can we also automatically setup a network namespace for the container?

For example, I might want to create a virtual network interface inside the container and hook it up with a TUN device on the host. That might allow to use the usual DHCP infrastructure to assign addresses to containers.

Systemd lightweight containers

Posted Feb 7, 2013 21:57 UTC (Thu) by mezcalero (subscriber, #45103) [Link] (1 responses)

Currently nspawn has two modes: a) inherited network from the host, or b) no connectivity at all, only a private loopback device and nothing else.

We might add more later on, the kernel certainly supports other modes. We try to be careful though that we don't end up with too much complexity, after all nspawn really should stay the simple tool that just works, rather than this super-configurable beast.

Systemd lightweight containers

Posted Feb 7, 2013 22:00 UTC (Thu) by Cyberax (✭ supporter ✭, #52523) [Link]

Makes sense. Is it possible to attach scripted hooks that will set up the networking infrastructure? Also, how to connect a new interface to the accepted socket?

Systemd lightweight containers

Posted Feb 7, 2013 15:56 UTC (Thu) by nybble41 (subscriber, #55106) [Link] (3 responses)

> [UID namespace] support in file systems is really awkward (if you processes has multiple UIDs, but your file system only maintains one per file, how could that ever work?), so I kinda get the impression they create more problems than they solve.

I wouldn't expect that to be as difficult as you make it sound. The filesystem should see a single UID within its own namespace; if I mount a filesystem and then create a UID namespace mapping UID 0 to UID 1000, then a process with UID 0 inside the namespace and UID 1000 outside should appear to the filesystem as UID 1000. On the other hand, if I created the UID namespace first and then mounted the filesystem inside it, the filesystem should see UID 0, since the filesystem and the process are in the same UID namespace.

Systemd lightweight containers

Posted Feb 7, 2013 21:55 UTC (Thu) by mezcalero (subscriber, #45103) [Link] (2 responses)

So, you boot your OS in your container, and it uses like a 50 different UIDs, because it runs various daemons unprivileged. And all these shall map to the same UID 1000 on the host, and the file system. Which component then knows how the files on disk map to those 50 different UIDs? How would that ever work?

Systemd lightweight containers

Posted Feb 7, 2013 22:20 UTC (Thu) by nybble41 (subscriber, #55106) [Link]

You make a good point. I think that you would need to map multiple container UIDs to multiple UIDs on the host if you want a filesystem mounted outside the container to keep them separate. IIRC the UID namespace code allows each container UID to map to a different host UID.

Mapping from container to host is always well-defined, but I'm not sure what the kernel does when the reverse translation is one-to-many. Most likely it just picks the first match, so all UID 1000 files would appear to be owned by root. (However, the permissions check should be performed using UID 1000 on the host side, in the filesystem's namespace, regardless of what the processes inside the container see.)

Systemd lightweight containers

Posted Feb 7, 2013 23:33 UTC (Thu) by zuki (subscriber, #41808) [Link]

Eric Biederman has a helper library which reserves a range of UIDs on the host and let's users use them (http://thread.gmane.org/gmane.linux.kernel.containers/25062). Afaicu, it is up to the user which UID means what.