genuinetools / binctr

Fully static, unprivileged, self-contained, containers as executable binaries.

binctr

Create fully static, including rootfs embedded, binaries that pop you directly into a container. Can be run by an unprivileged user.

Check out the blog post: blog.jessfraz.com/post/getting-towards-real-sandbox-containers.

This is based off a crazy idea from @crosbymichael who first embedded an image in a binary :D

HISTORY: This project used to use a POC fork of libcontainer until @cyphar got rootless containers into upstream! Woohoo! Check out the original thread on the mailing list.

Table of Contents

• Checking out this repo
• Building
• Running

• Cool things

Checking out this repo

$ git clone [email protected]:genuinetools/binctr.git

Building

You will need libapparmor-dev and libseccomp-dev.

Most importantly you need userns in your kernel (CONFIG_USER_NS=y) or else this won't even work.

# building the alpine example
$ make alpine
Static container created at: ./alpine

# building the busybox example
$ make busybox
Static container created at: ./busybox

# building the cl-k8s example
$ make cl-k8s
Static container created at: ./cl-k8s

Running

$ ./alpine
$ ./busybox
$ ./cl-k8s

Cool things

The binary spawned does NOT need to oversee the container process if you run in detached mode with a PID file. You can have it watched by the user mode systemd so that this binary is really just the launcher :)

binctr's Issues

required Go version

Hi,

I've failed to run make alpine on Ubuntu 18.04 with Golang 1.10 on Vagrant with the following errors

undefined: parseMountTable
undefined: parseInfoFile

I get #13 with Go 1.14.

Any ideas how to fix this?

Thanks :)

windows feasibility

What would the feasibility be of running something like this on Windows, perhaps using Cygwin or MinGW?

"multiple definition..." errors when building example images on ubuntu 18.04

binctr$ make busybox
+ busybox
go generate ./examples/busybox/...
2018/12/23 16:35:56 image not found locally, pulling the image
pulling docker.io/library/busybox:latest
pulling layer sha256:59788edf1f3e78cd0ebe6ce1446e9d10788225db3dedcfd1a59f764bad2b2690
pulling layer sha256:90e01955edcd85dac7985b72a8374545eac617ccdddcc992b732e43cd42534af
skipping config sha256:59788edf1f3e78cd0ebe6ce1446e9d10788225db3dedcfd1a59f764bad2b2690
unpacking sha256:90e01955edcd85dac7985b72a8374545eac617ccdddcc992b732e43cd42534af
CGO_ENABLED=1 go build \
			-tags "seccomp apparmor static_build" \
			-ldflags "-w -X github.com/genuinetools/binctr/version.GITCOMMIT=db50a63 -X github.com/genuinetools/binctr/version.VERSION=v0.0.0 -extldflags -static" -o busybox ./examples/busybox/...
# _/home/sam/Downloads/binctr/examples/busybox
/usr/lib/go-1.10/pkg/tool/linux_amd64/link: running gcc failed: exit status 1
/tmp/go-link-592025349/000014.o: In function `_cgo_f404b13b0081_Cfunc_sysconf':
/tmp/go-build/cgo-gcc-prolog:32: multiple definition of `_cgo_f404b13b0081_Cfunc_sysconf'
/tmp/go-link-592025349/000012.o:/tmp/go-build/cgo-gcc-prolog:32: first defined here
/tmp/go-link-592025349/000033.o:/home/sam/go/src/github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:91: multiple definition of `C_VERSION_MICRO'
/tmp/go-link-592025349/000010.o:/home/sam/go/src/github.com/genuinetools/binctr/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:125: first defined here
/tmp/go-link-592025349/000033.o:/home/sam/go/src/github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:90: multiple definition of `C_VERSION_MINOR'
/tmp/go-link-592025349/000010.o:/home/sam/go/src/github.com/genuinetools/binctr/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:124: first defined here
/tmp/go-link-592025349/000033.o:/home/sam/go/src/github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:89: multiple definition of `C_VERSION_MAJOR'
/tmp/go-link-592025349/000010.o:/home/sam/go/src/github.com/genuinetools/binctr/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:123: first defined here
/tmp/go-link-592025349/000033.o:/home/sam/go/src/github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:87: multiple definition of `C_CMP_MASKED_EQ'
/tmp/go-link-592025349/000010.o:/home/sam/go/src/github.com/genuinetools/binctr/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:121: first defined here
/tmp/go-link-592025349/000033.o:/home/sam/go/src/github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:86: multiple definition of `C_CMP_GT'
/tmp/go-link-592025349/000010.o:/home/sam/go/src/github.com/genuinetools/binctr/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:120: first defined here
/tmp/go-link-592025349/000033.o:/home/sam/go/src/github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:85: multiple definition of `C_CMP_GE'
/tmp/go-link-592025349/000010.o:/home/sam/go/src/github.com/genuinetools/binctr/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:119: first defined here
/tmp/go-link-592025349/000033.o:/home/sam/go/src/github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:84: multiple definition of `C_CMP_EQ'
/tmp/go-link-592025349/000010.o:/home/sam/go/src/github.com/genuinetools/binctr/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:118: first defined here
/tmp/go-link-592025349/000033.o:/home/sam/go/src/github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:83: multiple definition of `C_CMP_LE'
/tmp/go-link-592025349/000010.o:/home/sam/go/src/github.com/genuinetools/binctr/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:117: first defined here
/tmp/go-link-592025349/000033.o:/home/sam/go/src/github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:82: multiple definition of `C_CMP_LT'
/tmp/go-link-592025349/000010.o:/home/sam/go/src/github.com/genuinetools/binctr/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:116: first defined here
/tmp/go-link-592025349/000033.o:/home/sam/go/src/github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:81: multiple definition of `C_CMP_NE'
/tmp/go-link-592025349/000010.o:/home/sam/go/src/github.com/genuinetools/binctr/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:115: first defined here
/tmp/go-link-592025349/000033.o:/home/sam/go/src/github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:79: multiple definition of `C_ATTRIBUTE_TSYNC'
/tmp/go-link-592025349/000010.o:/home/sam/go/src/github.com/genuinetools/binctr/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:113: first defined here
/tmp/go-link-592025349/000033.o:/home/sam/go/src/github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:78: multiple definition of `C_ATTRIBUTE_NNP'
/tmp/go-link-592025349/000010.o:/home/sam/go/src/github.com/genuinetools/binctr/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:112: first defined here
/tmp/go-link-592025349/000033.o:/home/sam/go/src/github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:77: multiple definition of `C_ATTRIBUTE_BADARCH'
/tmp/go-link-592025349/000010.o:/home/sam/go/src/github.com/genuinetools/binctr/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:111: first defined here
/tmp/go-link-592025349/000033.o:/home/sam/go/src/github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:76: multiple definition of `C_ATTRIBUTE_DEFAULT'
/tmp/go-link-592025349/000010.o:/home/sam/go/src/github.com/genuinetools/binctr/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:110: first defined here
/tmp/go-link-592025349/000033.o:/home/sam/go/src/github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:74: multiple definition of `C_ACT_ALLOW'
/tmp/go-link-592025349/000010.o:/home/sam/go/src/github.com/genuinetools/binctr/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:102: first defined here
/tmp/go-link-592025349/000033.o:/home/sam/go/src/github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:73: multiple definition of `C_ACT_TRACE'
/tmp/go-link-592025349/000010.o:/home/sam/go/src/github.com/genuinetools/binctr/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:101: first defined here
/tmp/go-link-592025349/000033.o:/home/sam/go/src/github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:72: multiple definition of `C_ACT_ERRNO'
/tmp/go-link-592025349/000010.o:/home/sam/go/src/github.com/genuinetools/binctr/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:100: first defined here
/tmp/go-link-592025349/000033.o:/home/sam/go/src/github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:71: multiple definition of `C_ACT_TRAP'
/tmp/go-link-592025349/000010.o:/home/sam/go/src/github.com/genuinetools/binctr/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:99: first defined here
/tmp/go-link-592025349/000033.o:/home/sam/go/src/github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:70: multiple definition of `C_ACT_KILL'
/tmp/go-link-592025349/000010.o:/home/sam/go/src/github.com/genuinetools/binctr/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:98: first defined here
/tmp/go-link-592025349/000033.o:/home/sam/go/src/github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:68: multiple definition of `C_ARCH_S390X'
/tmp/go-link-592025349/000010.o:/home/sam/go/src/github.com/genuinetools/binctr/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:96: first defined here
/tmp/go-link-592025349/000033.o:/home/sam/go/src/github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:67: multiple definition of `C_ARCH_S390'
/tmp/go-link-592025349/000010.o:/home/sam/go/src/github.com/genuinetools/binctr/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:95: first defined here
/tmp/go-link-592025349/000033.o:/home/sam/go/src/github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:66: multiple definition of `C_ARCH_PPC64LE'
/tmp/go-link-592025349/000010.o:/home/sam/go/src/github.com/genuinetools/binctr/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:94: first defined here
/tmp/go-link-592025349/000033.o:/home/sam/go/src/github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:65: multiple definition of `C_ARCH_PPC64'
/tmp/go-link-592025349/000010.o:/home/sam/go/src/github.com/genuinetools/binctr/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:93: first defined here
/tmp/go-link-592025349/000033.o:/home/sam/go/src/github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:64: multiple definition of `C_ARCH_PPC'
/tmp/go-link-592025349/000010.o:/home/sam/go/src/github.com/genuinetools/binctr/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:92: first defined here
/tmp/go-link-592025349/000033.o:/home/sam/go/src/github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:63: multiple definition of `C_ARCH_MIPSEL64N32'
/tmp/go-link-592025349/000010.o:/home/sam/go/src/github.com/genuinetools/binctr/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:91: first defined here
/tmp/go-link-592025349/000033.o:/home/sam/go/src/github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:62: multiple definition of `C_ARCH_MIPSEL64'
/tmp/go-link-592025349/000010.o:/home/sam/go/src/github.com/genuinetools/binctr/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:90: first defined here
/tmp/go-link-592025349/000033.o:/home/sam/go/src/github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:61: multiple definition of `C_ARCH_MIPSEL'
/tmp/go-link-592025349/000010.o:/home/sam/go/src/github.com/genuinetools/binctr/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:89: first defined here
/tmp/go-link-592025349/000033.o:/home/sam/go/src/github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:60: multiple definition of `C_ARCH_MIPS64N32'
/tmp/go-link-592025349/000010.o:/home/sam/go/src/github.com/genuinetools/binctr/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:88: first defined here
/tmp/go-link-592025349/000033.o:/home/sam/go/src/github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:59: multiple definition of `C_ARCH_MIPS64'
/tmp/go-link-592025349/000010.o:/home/sam/go/src/github.com/genuinetools/binctr/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:87: first defined here
/tmp/go-link-592025349/000033.o:/home/sam/go/src/github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:58: multiple definition of `C_ARCH_MIPS'
/tmp/go-link-592025349/000010.o:/home/sam/go/src/github.com/genuinetools/binctr/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:86: first defined here
/tmp/go-link-592025349/000033.o:/home/sam/go/src/github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:57: multiple definition of `C_ARCH_AARCH64'
/tmp/go-link-592025349/000010.o:/home/sam/go/src/github.com/genuinetools/binctr/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:85: first defined here
/tmp/go-link-592025349/000033.o:/home/sam/go/src/github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:56: multiple definition of `C_ARCH_ARM'
/tmp/go-link-592025349/000010.o:/home/sam/go/src/github.com/genuinetools/binctr/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:84: first defined here
/tmp/go-link-592025349/000033.o:/home/sam/go/src/github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:55: multiple definition of `C_ARCH_X32'
/tmp/go-link-592025349/000010.o:/home/sam/go/src/github.com/genuinetools/binctr/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:83: first defined here
/tmp/go-link-592025349/000033.o:/home/sam/go/src/github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:54: multiple definition of `C_ARCH_X86_64'
/tmp/go-link-592025349/000010.o:/home/sam/go/src/github.com/genuinetools/binctr/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:82: first defined here
/tmp/go-link-592025349/000033.o:/home/sam/go/src/github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:53: multiple definition of `C_ARCH_X86'
/tmp/go-link-592025349/000010.o:/home/sam/go/src/github.com/genuinetools/binctr/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:81: first defined here
/tmp/go-link-592025349/000033.o:/home/sam/go/src/github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:52: multiple definition of `C_ARCH_NATIVE'
/tmp/go-link-592025349/000010.o:/home/sam/go/src/github.com/genuinetools/binctr/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:80: first defined here
/tmp/go-link-592025349/000033.o:/home/sam/go/src/github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:30: multiple definition of `C_ARCH_BAD'
/tmp/go-link-592025349/000010.o:/home/sam/go/src/github.com/genuinetools/binctr/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:30: first defined here
/tmp/go-link-592025349/000029.o: In function `mygetgrouplist':
/build/golang-1.10-WILBlV/golang-1.10-1.10.4/src/os/user/getgrouplist_unix.go:15: warning: Using 'getgrouplist' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
/tmp/go-link-592025349/000028.o: In function `mygetgrgid_r':
/build/golang-1.10-WILBlV/golang-1.10-1.10.4/src/os/user/cgo_lookup_unix.go:38: warning: Using 'getgrgid_r' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
/tmp/go-link-592025349/000028.o: In function `mygetgrnam_r':
/build/golang-1.10-WILBlV/golang-1.10-1.10.4/src/os/user/cgo_lookup_unix.go:43: warning: Using 'getgrnam_r' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
/tmp/go-link-592025349/000028.o: In function `mygetpwnam_r':
/build/golang-1.10-WILBlV/golang-1.10-1.10.4/src/os/user/cgo_lookup_unix.go:33: warning: Using 'getpwnam_r' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
/tmp/go-link-592025349/000028.o: In function `mygetpwuid_r':
/build/golang-1.10-WILBlV/golang-1.10-1.10.4/src/os/user/cgo_lookup_unix.go:28: warning: Using 'getpwuid_r' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
/tmp/go-link-592025349/000007.o: In function `_cgo_f7895c2c5a3a_C2func_getaddrinfo':
/tmp/go-build/cgo-gcc-prolog:46: warning: Using 'getaddrinfo' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
collect2: error: ld returned 1 exit status

Makefile:29: recipe for target 'busybox' failed

Same for alpine.

Question: Converting Dockerfiles into Binaries

Hey, is it possible to convert Dockerfiles into binaries with this?

This repository is over its data quota (LFS)

An error occurs when you try to clone the repository:

Git LFS: (0 of 3 files) 0 B / 39.98 MB                                                                                                                                
batch response: This repository is over its data quota. Purchase more data packs to restore access.
error: failed to fetch some objects from 'https://github.com/genuinetools/binctr.git/info/lfs'

how to make containers for this?

e.g. lets say I wanted to use an ubuntu 18.04 server container. How would I go about doing that? Does this use Docker? I'd be happy to add to the docs with this info once I know how.

executing setns process caused "exit status 46"

I'm not sure if there are certain environments that these static binaries can't run in, but this is what I get when I try to execute ./alpine after building it:

~/go/src/binctr # ./alpine 
FATA[0000] container_linux.go:336: starting container process caused "process_linux.go:86: executing setns process caused \"exit status 46\"" 

This is from within an Alpine docker container itself, which may be the issue?

The kernel has CONFIG_USER_NS set:

~/go/src/binctr # gzip -cd /proc/config.gz | grep CONFIG_USER_NS
CONFIG_USER_NS=y

Full steps to reproduce (from within docker run -it alpine sh):

echo http://nl.alpinelinux.org/alpine/edge/testing >> /etc/apk/repositories
echo http://nl.alpinelinux.org/alpine/edge/community >> /etc/apk/repositories
apk add --no-cache build-base linux-headers libapparmor-dev libseccomp-dev git go dep
mkdir -p ~/go/src
cd ~/go/src
git clone https://github.com/genuinetools/binctr
cd binctr
dep ensure
make alpine
./alpine

Also, if I set Terminal: false in container.SpecOpts in main.go and rebuild/rerun, I get this warning (before it exits with the same error as above):

nsenter: failed to unshare namespaces: Operation not permitted