Login to a guix container

Login to a guix container

[Pjotr Prins]

I was just thinking that it should be possible to login with ssh into
a GNU Guix shell running in a container that gets fired up by the
sshd. I am thinking about a safe shell for fetching files. If this
works no chroot setup is required.

Or is this a really dumb idea :)

Pj.

Re: Login to a guix container

[Ryan Prior]

[-- Attachment #1: Type: text/plain, Size: 611 bytes --]

On January 24, 2021, Pjotr Prins <pjotr.public12@thebird.nl> wrote:
> I was just thinking that it should be possible to login with ssh into
> a GNU Guix shell running in a container that gets fired up by the
> sshd. I am thinking about a safe shell for fetching files. If this
> works no chroot setup is required.
>
> Or is this a really dumb idea :)

I haven't seen any serious audit investigating security properties of
Guix containers. I do not think it's dumb to try this as an experiment,
but I do think it would be malpractice to trust user data with this
system before appropriately thorough evaluation.

[-- Attachment #2: Type: text/html, Size: 2915 bytes --]

Re: Login to a guix container

[Ricardo Wurmus]

Ryan Prior <ryanprior@hey.com> writes:

> On January 24, 2021, Pjotr Prins <pjotr.public12@thebird.nl> wrote:
>> I was just thinking that it should be possible to login with ssh into
>> a GNU Guix shell running in a container that gets fired up by the
>> sshd. I am thinking about a safe shell for fetching files. If this
>> works no chroot setup is required.
>>
>> Or is this a really dumb idea :)
>
> I haven't seen any serious audit investigating security properties of
> Guix containers. I do not think it's dumb to try this as an experiment,
> but I do think it would be malpractice to trust user data with this
> system before appropriately thorough evaluation.

In your requirements for an audit, how does a “Guix container” differ
from a “Linux container”?  Guix uses the kernel features like cloning
namespaces and unsharing the filesystem directly.  It merely mounts
individual store locations into the filesystem namespace.

“Malpractice” is a very big word for using user namespaces instead of
chroot without a “serious audit”.

-- 
Ricardo

Re: Login to a guix container

[Pjotr Prins]

On Mon, Jan 25, 2021 at 08:29:32AM +0100, Ricardo Wurmus wrote:
> In your requirements for an audit, how does a “Guix container” differ
> from a “Linux container”?  Guix uses the kernel features like cloning
> namespaces and unsharing the filesystem directly.  It merely mounts
> individual store locations into the filesystem namespace.
> 
> “Malpractice” is a very big word for using user namespaces instead of
> chroot without a “serious audit”.

I agree. The alternative is using sftp chroot - if it is for file
transfers only, or a full chroot. A container should be safer as long
as we consider the Linux kernel itself safe. The reason I posed the
question was just that I was thinking the solution may be a bit over
the top.

Maybe more over the top would be to run Linux or even GNU Hurd in
qemu/kvm. The more I read about the GNU Hurd the more I like it (I
read this stuff for relaxation rather than work ;). Maybe we'll
experiment with that a little too. We can easily dedicate 1GB of RAM
for such VMs.

Anyway, off-topic on guix-dev, so I apologise. I must say that 'guix
environment -C' is one of the greatest Guix inventions and I just
start thinking of more applications beyond hosting web servers and
development environments. It is lovely :). Thanks everyone!

Pj.

Re: Login to a guix container

[Ricardo Wurmus]

Pjotr Prins <pjotr.public12@thebird.nl> writes:

> Anyway, off-topic on guix-dev, so I apologise. I must say that 'guix
> environment -C' is one of the greatest Guix inventions and I just
> start thinking of more applications beyond hosting web servers and
> development environments. It is lovely :). Thanks everyone!

I agree.  I’m currently experimenting with it to see if it can replace a
proprietary deployment of Shiny Server here at the institute.  The idea
is to automatically spawn a containerized environment for an R Shiny
application when a user visits the application’s URL.

-- 
Ricardo