friz-zy / pyspaces

Works with Linux namespaces througth glibc with pure python

pyspaces

Works with Linux namespaces through glibc with pure python

discuss: reddit, habrahabr

Goals

There is so many beautiful tools like docker, rocket and vagga written in go and rust, but none in python. I think that is because there is no easy way to work with linux namespaces in python:

• you can use asylum - a project that looks dead and with a codebase hosted not on mainstream hub like github
• or you can use the python-libvirt bindings with a big layer of abstraction
• or just use the native glibc library with ctypes
• otherwise subprocess.Popen -- your choice

I want to change this: I want to create native python bindings to glibc with interface of python multiprocessing.Process.

PS: you can look at python-nsenter too, it's looks awesome.

PPS: new project from author of asylum - butter

Example

First simple example:

import os
from pyspaces import Container


def execute(argv):
    os.execvp(argv[0], argv)

cmd = "mount -t proc proc /proc; ps ax"
c = Container(target=execute, args=(('bash', '-c', cmd),),
              uid_map='0 1000 1',
              newpid=True, newuser=True, newns=True
              )
c.start()
print("PID of child created by clone() is %ld\n" % c.pid)
c.join()
print("Child returned: pid %s, status %s" % (c.pid, c.exitcode))

output:

PID of child created by clone() is 15978

PID TTY      STAT   TIME COMMAND
1   pts/19   S+     0:00 bash -c mount -t proc proc /proc; ps ax
3   pts/19   R+     0:00 ps ax

Child returned: pid 15978, status 0

CLI

space execute -v --pid --mnt --user --uid 1000 --gid 1000 bash -c 'mount -t proc /proc; ps ax'

space chroot --pid --uid '0 1000 1' ~/.local/share/lxc/ubuntu/rootfs/ /bin/ls /home/

space inject --net --mnt 19840 bash

Note: If the program you're trying to exec is dynamically linked, and the dynamic linker is not present in /lib in the chroot environment - you will get the following error: "OSError: [Errno 2] No such file or directory". You need all the other files the dynamic-linked program depends on, including shared libraries and any essential configuration/tables/etc in the new root directories. src

Security

Read this article please

Changelog

on github
digest

TODO

• namespaces: clone & Container
• CLI
• Chroot
• setns & inject
• cgroups
• SCM: apparmor & selinux
• capabilities
• mount
• network
• move CLI to separate package
• addons
• container list
• support for lxc, vagga, rocket, docker, etc...
• ...
• one tool for rule them all!!1

pyspaces's Issues

Is this project being developed or abandoned?

This would be a great option to run unsafe code. Using python to run basic tasks in LLM-based architectures is becoming very popular. This requires running code generated by LLMs.
While we could use actual docker container and marshal data between them, pyspaces look like a much better solution to create containers on the fly (basic namespaces) and run a code there.

RuntimeError: Can not execute clone Ubuntu 13

After pip install pyspaces

adminuser@adminuser-VirtualBox:~/git/_test$ space chroot --pid --uid '0 1000 1' ~/.local/share/lxc/ubuntu/rootfs/ /bin/ls /home/

Traceback (most recent call last): File "/usr/local/bin/space", line 9, in <module> load_entry_point('pyspaces==1.2.2', 'console_scripts', 'space')() File "/usr/local/lib/python2.7/dist-packages/pyspaces/cli.py", line 99, in cli args.func(args, extra) File "/usr/local/lib/python2.7/dist-packages/pyspaces/cli.py", line 142, in chroot c.start() File "/usr/lib/python2.7/multiprocessing/process.py", line 130, in start self._popen = Popen(self) File "/usr/local/lib/python2.7/dist-packages/pyspaces/cloning.py", line 102, in __init__ 'Can not execute clone' RuntimeError: Can not execute clone

Is the project still under development?

Any update, deprecated or no need to upgrade?

I want to use your project to jail processes instead of Docker

mount userspace (space execute --mnt) does not work

mysys / # mount | grep /mnt
mysys / # python2.7 /usr/bin/space execute --pid --mnt bash -c 'mount -t tmpfs tmpfs /mnt'
mysys / # mount | grep /mnt
tmpfs on /mnt type tmpfs (rw,relatime)

From the above experiment, we can see that the /mnt mount is not isolated in the "mount namespace" of the new process.

compare to unshare, which behaves correctly:

mysys / # mount | grep /mnt
mysys / # unshare -m bash -c 'mount -t tmpfs tmpfs /mnt'
mysys / # mount | grep /mnt

It is very ugly to call "unshare" in my python script compared to the pyspaces.Container API.
Although the experiment is done with CLI, but I know the API behaves the same.

inspect.getargspec vs inspect.getfullargspec?

fpemud@l02107b ~/workspace/strict_pgs $ space execute -v --pid --mnt --user --uid 1000 --gid 1000 bash -c 'mount -t proc /proc; ps ax'
Traceback (most recent call last):
  File "/usr/bin/space", line 9, in <module>
    load_entry_point('pyspaces==1.4', 'console_scripts', 'space')()
  File "/usr/lib64/python3.3/site-packages/pyspaces/cli.py", line 133, in cli
    args.func(args, extra)
  File "/usr/lib64/python3.3/site-packages/pyspaces/cli.py", line 152, in execute
    all=args.all
  File "/usr/lib64/python3.3/site-packages/pyspaces/process.py", line 188, in __init__
    for k in getargspec(Process.__init__).args:
  File "/usr/lib64/python3.3/inspect.py", line 826, in getargspec
    raise ValueError("Function has keyword-only arguments or annotations"
ValueError: Function has keyword-only arguments or annotations, use getfullargspec() API which can support them

The error disappears after I change getargspec to getfullargspec.
Is it a bug? Should I submit a pull request?

mount userspace (space execute --mnt) does not work

mysys / # mount | grep /mnt
mysys / # python2.7 /usr/bin/space execute --mnt bash -c 'mount -t tmpfs tmpfs /mnt'
mysys / # mount | grep /mnt
tmpfs on /mnt type tmpfs (rw,relatime)

From the above experiment, we can see that the /mnt mount is not isolated in the "mount namespace" of the new process.

unshare behaves correctly on my system:

mysys / # mount | grep /mnt
mysys / # unshare -m bash -c 'mount -t tmpfs tmpfs /mnt'
mysys / # mount | grep /mnt

It is very ugly to call "unshare" in my python script compared to the pyspaces.Container API.
Although the experiment is done with CLI, but I know the API behaves the same.