From 8c523bd38362904808c0359d772d6593809befb6 Mon Sep 17 00:00:00 2001 From: Inga Date: Sun, 4 Sep 2022 15:23:24 +0200 Subject: [PATCH] info on lxd --- README.md | 54 ++++++++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 52 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 6bd4c50..fa8b410 100644 --- a/README.md +++ b/README.md @@ -543,11 +543,61 @@ Now exit root shell (just with `exit`), and try `lxc-console -n CONTAINERNAME`. You should be able to log in using the new username and password. (To exit lxc console, use Ctrl+A, Q) +### Alternatively: unprivileged LXC using LXD + +#### Security notes + +Note that with LXD, unprivileged containers run under root, which is not supposed to give them any extra privileges +(source: https://discuss.linuxcontainers.org/t/privileged-and-unprivileged-containers/12060/2), but this implies that: + +Containers can only be managed with LXD using root access. +Which means either `doas` for every command (including connecting to the container shell), +or adding your user to the `lxd` group which will have access to LXD daemon, +**which will effectively give your user passwordless sudo (since access to LXD daemon can trivially be used to gain root privileges), +so that any process running under your user can trivially gain root privileges on the host** +(which is for some reason not considered by LXD maintainers to be a problem). + +**DO NOT add your user to the `lxd` group, and DO NOT uncomment ` --group lxd` in `/etc/conf.d/lxd`** + +Instead the secure way of doing things would probably be to only use lxd as a root, +and connect to the container using ssh. + +#### Containers support + +As simple as +``` +apk add lxd lxd-client lxcfs dbus +rc-update add lxc +rc-update add lxd +rc-update add lxcfs +rc-update add dbus +doas reboot +``` + +Networking with routing should work automatically. + +#### Creating container + +``` +doas lxc launch images:alpine/edge -c security.nesting=true -c security.privileged=false test-alpine-container +doas lxc exec test-alpine-container -- /bin/ash +``` +Networking should work inside of container. + ### Docker -(inside LXC) +#### (inside LXC) + +TODO once nesting in LXC works (reference: https://discuss.linuxcontainers.org/t/lxc-on-alpine-host-sys-fs-cgroup-is-not-mounted-into-unprivileged-alpine-guest/15026/1) + +#### (inside LXD) -TODO once nesting in LXC works +As simple as +``` +doas apk add docker +doas rc-update docker start +doas docker run hello-world +``` ## TODO