Installation of Debian (based) Linux distributions in a folder (chroot)
Chroot Use Cases
systemd-nspawn tool which acts as chroot(1) on steroids
it makes use of file system and PID namespaces to boot a simple lightweight container on a file system tree.
It can be used almost like chroot(1), except that the isolation from the host OS is much more complete, a lot more secure and even easier to use
systemd-nspawn is capable of booting a complete systemd or sysvinit OS in container with a single command.
- Booting of the container can take less than 3 seconds.
Note however that this protects the host OS only from accidental changes of its parameters. A process in the container can manually remount the file systems read-writeable and then change whatever it wants to change.
What are these issues? Related to running root vs non-root inside the container? Can these security holes nowadays be closed?
Since we are inside a VM already, can containers be used for better security?
Specify one or more additional capabilities to drop for the container. This allows running the container with fewer capabilities than the default (see above).
systemd-nspawn supports unprivileged containers,
, though the containers need to be booted as root.
That could be an OK limitation?
- https://unix.stackexchange.com/questions/145739/what-makes-systemd-nspawn-still-unsuitable-for-secure-container-setups [archive]
- https://opensource.com/business/14/7/docker-security-selinux [archive]
- https://people.kernel.org/brauner/runtimes-and-the-curse-of-the-privileged-container [archive]
To leave the chroot press keep holding key
CTRL and press key
5 quickly 3 times within 1 second. 
- https://wiki.archlinux.org/index.php/systemd-nspawn [archive]
- https://www.freedesktop.org/software/systemd/man/systemd-nspawn.html [archive]
mmdebstrap is a tool that can be used to securely create chroots.
debootstrap is insecure at times such as if APT is vulnerable and the fixed package only available from security.debian.org APT repository not the regular Debian repository because it can use only 1 APT repository at a time. And security.debian.org does not include all packages created to create a chroot.
- xchroot [archive]: chroot for users with Xorg/X11 forwarding and automatic mounting + aufs/unionfs read only root support.
- https://unix.stackexchange.com/questions/577065/connected-to-container-mycontainer-press-three-times-within-1s-to-exit-sessi [archive]
- alternative is multistrap (might be outdated, author has no experience with it)
This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! Read, understand and agree to Conditions for Contributions to Whonix ™, then Edit! Edits are held for moderation. Policy of Whonix Website and Whonix Chat and Policy On Nonfreedom Software applies.
Copyright (C) 2012 - 2020 ENCRYPTED SUPPORT LP. Whonix ™ is a trademark. Whonix ™ is a licensee [archive] of the Open Invention Network [archive]. Unless otherwise noted, the content of this page is copyrighted and licensed under the same Freedom Software license as Whonix ™ itself. (Why?)