From mboxrd@z Thu Jan 1 00:00:00 1970 From: ludo@gnu.org (Ludovic =?utf-8?Q?Court=C3=A8s?=) Subject: Running services in containers Date: Tue, 07 Feb 2017 15:25:15 +0100 Message-ID: <87d1euaxis.fsf@gnu.org> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:42998) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cb6hw-0002iV-I2 for guix-devel@gnu.org; Tue, 07 Feb 2017 09:25:25 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cb6hs-0004z7-1U for guix-devel@gnu.org; Tue, 07 Feb 2017 09:25:24 -0500 Received: from fencepost.gnu.org ([2001:4830:134:3::e]:39833) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cb6hr-0004z0-U5 for guix-devel@gnu.org; Tue, 07 Feb 2017 09:25:19 -0500 Received: from [193.50.110.68] (port=39578 helo=ribbon) by fencepost.gnu.org with esmtpsa (TLS1.2:RSA_AES_256_CBC_SHA1:256) (Exim 4.82) (envelope-from ) id 1cb6hr-0006y0-9B for guix-devel@gnu.org; Tue, 07 Feb 2017 09:25:19 -0500 List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: guix-devel Hi Guix! Those who didn=E2=80=99t have the luck to be at FOSDEM missed this not-so-v= isual demo I made of a Shepherd service running in a container. :-) I=E2=80=99ve polished the thing on my way back and pushed the result, using BitlBee as an example: http://git.savannah.gnu.org/cgit/guix.git/commit/?id=3D63302a4e55241a41ea= b4c21d7af9fbd0d5817459 http://git.savannah.gnu.org/cgit/guix.git/commit/?id=3Da062b6ca99ad61c9df= 473fe49a93d69f9698c59d It works nicely! The BitlBee daemon shares its network and user namespaces with the system but otherwise has a private /tmp and a private /var/run and only has access to /var/lib/bitlbee and /gnu/store. It should make it harder for an attacker to usefully exploit a remote code execution vulnerability such as the one recently reported=C2=B9. Of course BitlBee is a simple example, but I think it=E2=80=99d be nice to investigate what it takes to do the same for other services in the future. I=E2=80=99d like to write a post about it at some point. Ludo=E2=80=99. =C2=B9 https://bugs.bitlbee.org/ticket/1281