containers / containers/bubblewrap

Running sshd inside bubblewrap

Open
#787 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
8.7k
Forks
386
Avg merge
3d 17h
Merged PRs (30d)
11

Description

I am trying to run sshd in bubblewrap.

It fails on connection with this:
```
chown(/dev/pts/1, 1001, 5) failed: Operation not permitted
```

It used to work in previous versions of bubblewrap.

Here is roughly how I am running it:

```
# Start building the bwrap arguments array
# We run as root, so we map the host UID 0 to container UID 0
BWRAP_ARGS=(
# Can't use --unshare-all because we need to share user and it doesn't have a flag for that
--unshare-ipc
--unshare-pid
--unshare-uts
--unshare-cgroup
# We must SHARE net to allow SSHD to listen on the host interface
--share-net
#--share-user

# Process management
--die-with-parent
--new-session

# Base Filesystem
--bind "$CHROOT_DIR" /

# System Directories
--bind /proc /proc # Bind container /proc
--dev-bind /dev /dev # Bind container /dev (needed for GPU devices)
--bind /sys /sys # Bind container /sys (needed for driver info)
--tmpfs /tmp # Clean tmp
--tmpfs /run # Clean run
--dir /run/sshd # Ensure directory for sshd socket exists

# Capabilities
--cap-add CAP_SYS_CHROOT
--cap-add CAP_SETUID
--cap-add CAP_SETGID

# Data Persistence
--bind /data/home /home
)

...

exec unshare --map-root-user --map-auto \
bwrap "${BWRAP_ARGS[@]}" \
/usr/sbin/sshd -D -e -o LogLevel=VERBOSE
```

Am I missing some new flag?
I can provide more information if needed.
Thanks for your help.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.