MIME-Version: 1.0
References: <B623F07E-FD90-4D6B-B7A7-0B796019CF2C@extremeshok.com>
 <CAPxz1+YSaMQm4LWjn8mChpFbUfeDKFdaUrL1UrkqTTqEdj7LfQ@mail.gmail.com> <17daba0fa895aca68c6046b69a959723@c3f.net>
In-Reply-To: <17daba0fa895aca68c6046b69a959723@c3f.net>
From: Parke <parke.nexus@gmail.com>
Date: Mon, 29 Jun 2020 10:26:53 -0700
Message-ID: <CAPxz1+a+E3ZjTqKcLTxq8b6_X792kebCMV6zEwtqR+38A9_MCg@mail.gmail.com>
Subject: Re: Running Alpine's userland in a Linux user namespace via lxroot
To: j3s@c3f.net
Cc: ~alpine/users@lists.alpinelinux.org
Content-Type: text/plain; charset="UTF-8"

On Mon, Jun 29, 2020 at 9:45 AM <j3s@c3f.net> wrote:
> Docker just uses cgroups for isolation - same thing [lxroot] use[s],

I believe namespaces are distinct from cgroups (but I could be wrong).

From https://en.wikipedia.org/wiki/Cgroups#Namespace_isolation :
"While not technically part of the cgroups work, a related feature of
the Linux kernel is namespace isolation ..."

lxroot uses user namespaces, specifically:
the mount namespace
the network namespace
the process namespace
the user namespace

According to the above Wikipedia link, there is a "Cgroup namespace",
but I believe lxroot does not use the Cgroup namespace.

----

Another nifty consequence of lxroot's design is that you can lxroot
into '/' (the root directory itself), while at the same time doing
bind mounts and possibly mapping the uid and gid to zero, or dropping
network access.  This allows you to run software in an "altered
version" of the host OS itself.  (This might be somewhat similar to
firejail.  But, as with Docker, I have never used firejail.)