Vagga is a containerization tool without daemons

Re:Vagga is a containerization tool without daemons by jamescun on Friday February 12, 2016 @07:09AM (#11086663)

I don't understand this point:

  - Fully userspace containers, no need for elevated privileges

The most basic Linux container is constructed with chroot and namespaces, both of which require root privileges (or at least CAP_SYS_CHROOT and CAP_SYS_ADMIN respectively). Additionally managing layers with a union filesystem, unless utilising FUSE, will also require elevated privileges.

[ Parent | on HN ]

Re:Vagga is a containerization tool without daemons by jamescun on Friday February 12, 2016 @09:40AM (#11087449)

A more extensive look at the code, it requires the host root user to set `kernel.unprivileged_userns_clone=1` after which Vagga can perform privileged operations as a "root" user inside a user namespace.

[ Parent | on HN ]

Re:Vagga is a containerization tool without daemons by tailhook on Monday February 15, 2016 @05:06AM (#11102513)

Yes. But that's on debian (IIRC) kernel, i.e. the patched one. On stock kernel it requires CONFIG_USER_NS setting enabled, and it just works.

[ Parent | on HN ]

Re:Vagga is a containerization tool without daemons by the8472 on Friday February 12, 2016 @07:53AM (#11086832)

It can have root inside the new user namespace, which - i assume - is sufficient to chroot in its mount namespace.

[ Parent | on HN ]