Introduction
This is follow up to Build a Container from Scratch.
This time we will actually load up a PHP website inside the container.
Part 2: No Docker? No Problem! Part 2 - N-Tiered Application is available for our paid members.
Experiment
Terminal 1 - root user
Terminal 2 - user
NOTE: apparmor-restrict-unprivileged-userns
For Terminal 2, recent versions of ubuntu (24.xx and up?) introduced kernel.apparmor_restrict_unprivileged_userns which restricts unprivileged users from creating namespaces: noted here. You can either:
a) Use a root user instead for Terminal 2
OR
b) Run this command to temporarily disable the feature: sysctl -w kernel.apparmor_restrict_unprivileged_userns=0. Or you can do this to make it persist on reboot (NOT RECOMMENDED FOR SECURITY REASONS)
tee /etc/sysctl.d/99-unpriv-userns.conf <<EOF
kernel.apparmor_restrict_unprivileged_userns=0
EOF
sysctl --system
You can see all other kernel parameters by doing:
ls /proc/sys/kernel/ # lists all kernel parameters
cat /proc/sys/kernel/{filename} # shows 1 for enabled or 0 for not enabled
sysctl --all # lists ALL system parameters
sysctl --all | grep kernel. # lists props in /proc/sys/kernel
Go to Terminal 1
Set up bridge network for later:
ip link add name br0 type bridge;
ip addr add 172.16.2.11/24 brd + dev br0;
ip link set br0 up;
iptables -A FORWARD -i br0 -j ACCEPT;
sysctl -w net.ipv4.ip_forward=1
iptables -t nat -A POSTROUTING -s 172.16.2.0/24 -j MASQUERADE
Set up cgroups:
mkdir /sys/fs/cgroup/container_cpu
echo +cpu > /sys/fs/cgroup/cgroup.subtree_control
echo '50000 100000' | sudo tee /sys/fs/cgroup/container_cpu/cpu.max
Container 1
Go to Terminal 2
Download alpine:
mkdir c1;
cd c1;
wget http://dl-cdn.alpinelinux.org/alpine/v3.19/releases/x86_64/alpine-minirootfs-3.19.1-x86_64.tar.gz;
mkdir alpine;
tar -xzf alpine-minirootfs-3.19.1-x86_64.tar.gz -C alpine;
Configure Namespaces:
unshare -U -r /bin/bash
unshare --uts /bin/bash
hostname container1
unshare --pid --fork --mount-proc --ipc --net --cgroup /bin/bash
tail -F pizza
Go to Terminal 1
Find the pid, in this case it will be 1242:
root@evermight:~# ps auxf
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 939 0.0 0.1 17180 10788 ? Ss 21:34 0:00 \_ sshd: evermight [priv]
evermig+ 1045 0.1 0.0 17312 8060 ? S 21:35 0:00 | \_ sshd: evermight@pts/0
evermig+ 1046 0.0 0.0 8868 5816 pts/0 Ss 21:35 0:00 | \_ -bash
evermig+ 1164 0.0 0.0 8792 5524 pts/0 S 21:38 0:00 | \_ /bin/bash
evermig+ 1184 0.0 0.0 8792 5512 pts/0 S 21:39 0:00 | \_ /bin/bash
evermig+ 1241 0.0 0.0 5772 992 pts/0 S 21:39 0:00 | \_ unshare --pid --fork --mount-proc --
evermig+ 1242 0.0 0.0 8792 5584 pts/0 S 21:39 0:00 | \_ /bin/bash
evermig+ 1281 0.0 0.0 5772 1012 pts/0 S+ 21:41 0:00 | \_ sleep tail -F pizza
Configure container network:
pid=1242
ip link add veth0 type veth peer name ceth0
ip link set ceth0 netns /proc/$pid/ns/net;
ip link set veth0 up;
ip link set veth0 master br0;
echo $pid | sudo tee /sys/fs/cgroup/container_cpu/cgroup.procs
Go to Terminal 2
Complete networking and file system jail:
cip='172.16.2.20/24'
ip link set lo up
ip link set ceth0 up
ip addr add $cip dev ceth0
ip route add default via 172.16.2.11
mount --bind alpine alpine
cd alpine
mkdir root_fs
pivot_root . root_fs
umount -l root_fs
cd /
Update host so that you can reach alpine CDNs, replace 1.1.1.1 with whatever is given by nslookup dl-cdn.alpinelinux.org:
echo '1.1.1.1 dl-cdn.alpinelinux.org' >> /etc/hosts
Download and serve a php website:
apk update
apk add php curl
echo '<?php echo "<h1>It is currently <span style=\"color: red;\">".date("Y-m-d H:i:s")."</span></h1>"; ' > index.php
php -S 0.0.0.0:80 &
curl http://localhost
Go to Terminal 1
curl http://172.16.2.20
Configure iptables for NAT so that container is publicly accessible:
iptables -A FORWARD -p tcp -d 172.16.2.20 --dport 80 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 80 -j DNAT --to-destination 172.16.2.20:80
Now visit your http://your-server-ip.