[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Containers and chroot (was: openssh-server's default config is dangerous)



Le quintidi 25 messidor, an CCXXIV, Stefan Monnier a écrit :
> FWIW, I also find it disappointing that I can't do it in an etc file of
> some sort.

Yes, such an essential option should be integral to the system, not brought
by an obscure package. That the package exists is still better than nothing,
though.

>	      E.g. I often need something like this when running inside
> a chroot and always have trouble finding the clean&easy way to do it
> (IIUC dpkg should figure out on its own that it's running in a chroot,
> but it doesn't seem to work reliably enough in my experience, or maybe
> I misunderstood how "running in chroot" is expected to affect dpkg's
> behavior by default).

If both the outer and the inner systems use systemd, then you can use
systemd-nspawn instead of chroot. It will isolate a little more at the
kernel level (using namespaces) and mount the essential pseudo-filesystems,
and more importantly it starts a sub-instance of systemd that isolate the
services.

Regards,

-- 
  Nicolas George

Attachment: signature.asc
Description: Digital signature


Reply to: