Provisioning and usage of unprivileged LXC containers via indirect login or script
As I've discovered, managing LXC containers is fairly straightforward, but when building out a system for provisioning out user maintained instances of NodeBB, it was imperative that unprivileged LXC containers were used, so that in the event of shell breakout from NodeBB followed by privilege escalation of the
saas user, the
root user in the LXC container would only be an unprivileged user on the host machine.
During the course of development, I ran into numerous blockers when it came to managing LXC containers in unexpected circumstances. Namely:
- Using LXC in a subshell is not directly supported. This usually happens under one of the following two circumstances:
- After switching users via
su or executing
lxc-* commands as another user via
lxc-* commands via a program, application, or script. In my case, a Node.js application.