moody5bundle

this is the same as:

%wheel ALL=(ALL) NOPASSWD: ALL

effectively disabling sudo completely.

Yup, and based on that mapping table the process inside the container is not allowed to create another namespace and/or fuse-overlayfs. That's why you need to mount /dev/fuse into the container (you might also need cap_sys_admin and cap_mknod). There is another link from RedHat which also explains it:

https://www.redhat.com/sysadmin/podman-inside-container

You can run "capsh --print" to see your current capabilities. And to run a container without any capabilities:

podman run --cap-drop ALL -it fedora capsh --print

cgroups v1 had some issues:

https://nvd.nist.gov/vuln/detail/CVE-2022-0492

and:

https://nvd.nist.gov/vuln/detail/CVE-2022-0185

Maybe you should include this into your "research":

- https://opensource.com/article/19/2/how-does-rootless-podman...

- https://github.com/containers/podman/blob/main/docs/tutorial...

TL;DR

cgroup V2 support

Installing Podman

Install slirp4netns

Ensure fuse-overlayfs is installed

Docker is running a daemon with root privileges to start all containers. So if your start a container with "docker run -d ...." you talk to a privileged process. That in turn means, all spawned containers can have root privileges (docker run -v /etc/shadow ... to change the root password of your host). "rootless" actually means running a container process as a normal user. (less attack surface because of less permissions). So if you would run "podman -v /etc/shadow" as a normal user, you wouldn't have the permissions needed to open the file.

As simple as possible: Docker ("normally"): run every command inside container with full root permissions on host $root-> Docker -> container Docker/Podman ("rootless"): run every command as the current user $user-> container

Maybe take a look here for a better explanation: https://docs.docker.com/engine/security/#docker-daemon-attac...

that is exactly what this is intended for :) look at this dockerfile: https://github.com/mody5bundle/capps/blob/main/container/san... and this "config" lines https://github.com/mody5bundle/capps/blob/aec6a118139c2008c3... this will start a cheap "sandbox" aka a gnome-terminal window with its own filesystem and process tree. you just have to change the config file to mount a volume on the paths you want and maybe tweak the image to your likings :)

depends on your use case. I wanted a way of removing network access for my text editors and starting ephermal firefox instances that are completely independent from each other. Its just an easier way to hack around an application tbh.

Flatpak with Dockerfiles and yaml config! :)

i think they use bwrap as mentioned in a comment below. my use case is to restrict network access for example. Or running multiple firefox instances in parallel (so they dont have the same parent process / cookies etc.). or restrict memory for to 2G per container. there were just a few things i wanted to do that didn't quiet work with flatpak or snap.

Oh didn't know about bwrap yet! If i understand the wiki page correctly, you still need to get those binaries to your pc. So thats why i went with plain and simple dockerfiles.

if you want to remove network_mode=host you need to run firefox with the --no-xshm flag

here you go: https://github.com/mody5bundle/capps please feel free to open issues and pull requests :)

I will! cleaning up now and going to publish it later on github. The main idea was a least privilege approach to running simple desktop applications independent from the host OS and being able to control filesystem/network access on a per app basis. (spotify on fedora without flatpak or rpm-fusion repo's, not even sudo needed to install)

I am actually running a few of my daily applications, such as firefox, vscode, or spotify inside a podman container (rootless makes me feel a little safer). I build a small python script around it, which creates a desktop icon, tags the current version (so you can rollback), and updates the images after x amount of time. I'll clean it up and put it on github if someone is interested :)

that's probably what happened, i reached out to github and hope to get it changed. It just left me at unease. The mighty Linus involved in an organization that redirects to a crypto scam? Can't be!

Thank you, i just did!