Re: Running gobolinux containerized

--===============8885342146211314567==
Content-Type: multipart/alternative; boundary="000000000000ee71df058dfada47"

--000000000000ee71df058dfada47
Content-Type: text/plain; charset="UTF-8"

On Wed, Jul 17, 2019 at 4:16 PM Anshuman Aggarwal <
[email protected]> wrote:

> Hi all,
>  Now, I am trying to run gobolinux in a container (chroot/lxc/docker
> etc.) with Ubuntu 18.04 as host so I can work on it more till it can
> become my primary OS. Has this been tried or is there any known reason
> why this wouldn't work?
>
> I tried using chroot but I get this error message when I run commands:
>
> sudo: no tty present and no askpass program specified
>
> There are generic solutions online but I was wondering why this was
> happening with Gobo since it doesn't happen when I chroot from a
> livecd into ubuntu on the hard disk.
>
> Thanks
> Anshu
>

Hi,

The chroot issue seems to be related to missing device nodes on /dev. I
usually run the following script to chroot into Gobo:
```
mount -o bind /dev ./GoboLinux/dev
mount -o bind /proc ./GoboLinux/proc
mount -o bind /sys ./GoboLinux/sys
chroot ./GoboLinux
umount ./GoboLinux/sys
umount ./GoboLinux/proc
umount ./GoboLinux/dev
```

Ideally, we should have a Docker image so that people could explore Gobo
more freely. I looked into creating a Docker image based on GoboLinux a few
months ago, but I've hit a few bumps:
1. Gobohide is currently implemented as a kernel mod, which is not expected
to be available in the distro where Docker runs
2. We could have an alternative implementation of Gobohide using
LD_PRELOAD, but that's hackish and relies on passing environment variables
when starting the container, which I dislike
3. Sandboxing through overlays and union-mounts require special permissions

I didn't have the time to look into alternatives, so I gave up on that. I
welcome anybody willing into working around these issues.

Lucas

--000000000000ee71df058dfada47
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><div class=3D"gmail_default" style=3D"fon=
t-size:small">On Wed, Jul 17, 2019 at 4:16 PM Anshuman Aggarwal &lt;<a href=
=3D"mailto:[email protected]">[email protected]</a>&gt;=
 wrote:<br></div></div><div class=3D"gmail_quote"><blockquote class=3D"gmai=
l_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,20=
4,204);padding-left:1ex">Hi all,<br>
=C2=A0Now, I am trying to run gobolinux in a container (chroot/lxc/docker<b=
r>
etc.) with Ubuntu 18.04 as host so I can work on it more till it can<br>
become my primary OS. Has this been tried or is there any known reason<br>
why this wouldn&#39;t work?<br>
<br>
I tried using chroot but I get this error message when I run commands:<br>
<br>
sudo: no tty present and no askpass program specified<br>
<br>
There are generic solutions online but I was wondering why this was<br>
happening with Gobo since it doesn&#39;t happen when I chroot from a<br>
livecd into ubuntu on the hard disk.<br>
<br>
Thanks<br>
Anshu<br></blockquote><div><br></div><div class=3D"gmail_default" style=3D"=
font-size:small">Hi,</div><div class=3D"gmail_default" style=3D"font-size:s=
mall"><br></div><div class=3D"gmail_default" style=3D"font-size:small">The =
chroot issue seems to be related to missing device nodes on /dev. I usually=
 run the following script to chroot into Gobo:</div><div class=3D"gmail_def=
ault" style=3D"font-size:small">```</div><div class=3D"gmail_default" style=
=3D"font-size:small">mount -o bind /dev ./GoboLinux/dev</div><div class=3D"=
gmail_default" style=3D"font-size:small">mount -o bind /proc ./GoboLinux/pr=
oc</div><div class=3D"gmail_default" style=3D"font-size:small">mount -o bin=
d /sys ./GoboLinux/sys</div><div class=3D"gmail_default" style=3D"font-size=
:small">chroot ./GoboLinux</div><div class=3D"gmail_default" style=3D"font-=
size:small">umount ./GoboLinux/sys</div><div class=3D"gmail_default" style=
=3D"font-size:small">umount ./GoboLinux/proc<br></div><div class=3D"gmail_d=
efault" style=3D"font-size:small">umount ./GoboLinux/dev<br></div><div clas=
s=3D"gmail_default" style=3D"font-size:small">```</div><div class=3D"gmail_=
default" style=3D"font-size:small"><br></div><div class=3D"gmail_default" s=
tyle=3D"font-size:small">Ideally, we should have a Docker image so that peo=
ple could explore Gobo more freely. I looked into creating a Docker image b=
ased on GoboLinux a few months ago, but I&#39;ve hit a few bumps:</div><div=
 class=3D"gmail_default" style=3D"font-size:small">1. Gobohide is currently=
 implemented as a kernel mod, which is not expected to be available in the =
distro where Docker runs</div><div class=3D"gmail_default" style=3D"font-si=
ze:small">2. We could have an alternative implementation of Gobohide using =
LD_PRELOAD, but that&#39;s hackish and relies on passing environment variab=
les when starting the container, which I dislike</div><div class=3D"gmail_d=
efault" style=3D"font-size:small">3. Sandboxing through overlays and union-=
mounts require special permissions</div><div class=3D"gmail_default" style=
=3D"font-size:small"><br></div><div class=3D"gmail_default" style=3D"font-s=
ize:small">I didn&#39;t have the time to look into alternatives, so I gave =
up on that. I welcome anybody willing into working around these issues.</di=
v><div class=3D"gmail_default" style=3D"font-size:small"><br></div><div cla=
ss=3D"gmail_default" style=3D"font-size:small">Lucas</div><div class=3D"gma=
il_default" style=3D"font-size:small"><br></div></div></div>

--000000000000ee71df058dfada47--

--===============8885342146211314567==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KZ29ib2xpbnV4
LXVzZXJzIG1haWxpbmcgbGlzdApnb2JvbGludXgtdXNlcnNAbGlzdHMuZ29ib2xpbnV4Lm9yZwpo
dHRwOi8vbGlzdHMuZ29ib2xpbnV4Lm9yZy9tYWlsbWFuL2xpc3RpbmZvL2dvYm9saW51eC11c2Vy
cwo=

--===============8885342146211314567==--