Re: [svlug-announce] SVLUG Jan. 31st meeting: Michael Kerrisk on Understanding User Namespaces

Relevant to tonight's presentation, Michael also gave strong
recommendaiton to a blog article by Lizzie Dixon in San Franciso:
https://blog.lizzie.io/linux-containers-in-500-loc.html


Linux containers in 500 lines of code

Table of Contents:
  Container setup
  contained.c
    Namespaces
    Capabilties
      Dropped capabilities
      Retained Capabilities
    Mounts
    System Calls
      Disallowed System Calls
      Allowed System Calls
  Resources
  Networking


I've used Linux containers directly and indirectly for years, but I
wanted to become more familiar with them. So I wrote some code. This
used to be 500 lines of code, I swear, but I've revised it some since
publishing; I've ended up with about 70 lines more.

I wanted specifically to find a minimal set of restrictions to run
untrusted code. This isn't how you should approach containers on
anything with any exposure: you should restrict everything you can. But
I think it's important to know which permissions are categorically
unsafe! I've tried to back up things I'm saying with links to code or
people I trust, but I'd love to know if I missed anything.
[...]


Container setup

There are several complementary and overlapping mechanisms that make up
modern Linux containers. Roughly,

  o namespaces are used to group kernel objects into different sets that can
    be accessed by specific process trees. For example, pid namespaces limit
    the view of the process list to the processes within the namespace.
    There are a couple of different kind of namespaces. I'll go into this
    more later.
 o  capabilities are used here to set some coarse limits on what uid 0 can
    do.
 o  cgroups is a mechanism to limit usage of resources like memory, disk io,
    and cpu-time.
 o  setrlimit is another mechanism for limiting resource usage. It's older
    than cgroups, but can do some things cgroups can't.
[...]