Barco: Linux Containers from Scratch in C

#1

Post by lucavallin » Sun, Aug 06, 2023, 7:47 PM UTC

Barco: Linux Containers from Scratch in C
github.com

Re: Barco: Linux Containers from Scratch in C

#2

Post by lucavallin » Sun, Aug 06, 2023, 7:47 PM UTC

barco is a project I worked on to learn more about Linux containers and the Linux kernel, based on other guides on the internet.

Re: Barco: Linux Containers from Scratch in C

#3

Post by intelVISA » Sun, Aug 06, 2023, 7:54 PM UTC

lucavallin wrote: post #2

barco is a project I worked on to learn more about Linux containers and the Linux kernel, based on other guides on the internet.

awesome, thx for sharing this :)

Re: Barco: Linux Containers from Scratch in C

#4

Post by gjkood » Sun, Aug 06, 2023, 8:19 PM UTC

[flagged]

Re: Barco: Linux Containers from Scratch in C

#5

Post by CameronNemo » Sun, Aug 06, 2023, 8:21 PM UTC

gjkood wrote: post #4

[flagged]

Please don't complain about tangential annoyances—e.g. article or website formats, name collisions, or back-button breakage. They're too common to be interesting.

Re: Barco: Linux Containers from Scratch in C

#6

Post by shortrounddev2 » Sun, Aug 06, 2023, 8:31 PM UTC

Very cool, I was thinking of doing something similar in windows

Re: Barco: Linux Containers from Scratch in C

#7

Post by zamalek » Sun, Aug 06, 2023, 8:37 PM UTC

> barco enforces a minimal set of restrictions to run untrusted code, which is not recommended for production use, where a more robust solution should be used.

Aren't containers never suitable for running untrusted code? You need AppArmor, bwrap, or similar AFAIK.

Re: Barco: Linux Containers from Scratch in C

#8

Post by loeg » Sun, Aug 06, 2023, 8:41 PM UTC

zamalek wrote: post #7

> barco enforces a minimal set of restrictions to run untrusted code, which is not recommended for production use, where a more robust solution should be used. Aren't containers never suitable for running untrusted code? You need AppArmor, bwrap, or similar AFAIK.

I would probably point at a virtual machine for a convenient place to run untrusted code. It's not perfect -- there are VM escapes -- but it's more convenient than a dedicated, air-gapped machine.

Re: Barco: Linux Containers from Scratch in C

#9

Post by CameronNemo » Sun, Aug 06, 2023, 8:45 PM UTC

loeg wrote: post #8

zamalek wrote: post #7

> barco enforces a minimal set of restrictions to run untrusted code, which is not recommended for production use, where a more robust solution should be used. Aren't containers never suitable for running untrusted code? You need AppArmor, bwrap, or similar AFAIK.

I would probably point at a virtual machine for a convenient place to run untrusted code. It's not perfect -- there are VM escapes -- but it's more convenient than a dedicated, air-gapped machine.

GKE runs every kubelet in its own gvisor-like userspace hypervisor.

https://cloud.google.com/blog/products/containers-kubernetes...

Re: Barco: Linux Containers from Scratch in C

#10

Post by Philpax » Sun, Aug 06, 2023, 9:00 PM UTC

CameronNemo wrote: post #5

gjkood wrote: post #4

[flagged]

Please don't complain about tangential annoyances—e.g. article or website formats, name collisions, or back-button breakage. They're too common to be interesting.

GP was asking if it could cause an issue for the OP, not complaining about an annoyance. It's something that the OP may want to address.