AkihiroSuda

There is also elfconv (by my colleague): an AOT binary translator that directly converts Linux ELF to Wasm. https://yomaytk.github.io/elfconv-demo/

The Wasm port of the Linux kernel sounds quite interesting as it may potentially help improving the syscall compatibility of elfconv.

> endpoint: tcp://${{ secrets.BUILDKIT_HOST }}:9999

This should be protected with mTLS (https://docs.docker.com/build/drivers/remote/) or SSH (`endpoint: ssh://user@host`) to avoid potential cryptomining attack, etc.

> Also, buildx won't commit the intermediate layers during the build. So if something fails, you can't just grab the previous intermediate layer and do `docker run --entrypoint /bin/bash` on that layer to poke around.

`buildg debug` (Dockerfile debugger based on BuildKit) to rescue: https://github.com/ktock/buildg

> Podman is designed to help with this by providing stronger default security settings compared to Docker. Features like rootless containers, user namespaces, and seccomp profiles, while available in Docker, aren't enabled by default and often require extra setup.

Seccomp has been enabled by default since 2015: https://github.com/moby/moby/pull/18780

It is true that Rootless isn't enabled by default but its "extra setup" can be done with a single command (`dockerd-rootless-setuptool.sh install`)

> It requires non official tooling

Rootless Docker has been merged into the official since Docker 19.03, and graduated from experimental since Docker 20.10.

The "tooling" is available in the official apt/dnf repo too: - https://download.docker.com/linux/ubuntu/dists/jammy/pool/st... - https://download.docker.com/linux/centos/9/x86_64/stable/Pac...

Just merged #9054.

Sorry for that we had to revert #8789, but we are looking forward to seeing that PR submitted again with an alternative abstraction interface.

Nope. https://rootlesscontaine.rs/#non-examples-of-rootless-contai...

Set `sudo sysctl -w net.ipv4.ip_unprivileged_port_start=80`

Not really recently. Both were implemented almost simultaneously in circa June 2018.

https://github.com/AkihiroSuda/docker/commit/588a4e91fc8cb99... https://github.com/containers/podman/commit/19f5a504ffb14709...

Rootless Docker wasn't merged/released until Docker 19.03, though , but still it is already nearly 4 years old.

> The biggest problem with Docker is that its containers are effectively running as root.

Both Docker and Podman support rootless mode (and rootful mode).

> Because of its daemonless architecture, Podman can perform truly rootless operations.

Daemonless isn't really relevant to rootless.

containerd/buildkitd/dockerd have been supporting rootless mode too, and lots of rootless codes have been mutually ported over across containerd/buildkitd/dockerd and Podman.

> Docker-engine doesn't support running as a user other than root. Podman does.

Docker engine does.

Slirp networking does not need any suid bit or special capability.

The filesystem performance degradation was resolved in kernel 5.11 which added support for rootless overlayfs.

The network performance is caused by slirp (usermode TCP/IP) but it is being resolved too : https://github.com/rootless-containers/bypass4netns

> I guess rootless is some of the work that Docker (company) wanted to keep proprietary and out of this open-source project.

Rootless mode for Docker is completely FLOSS, and its main contributor (me) has even never worked for Docker (company).

https://github.com/moby/moby/blob/master/contrib/dockerd-roo...

https://github.com/rootless-containers

Podman 2.1 supports CNI networks (`podman network create`), so it might be worthful now

Podman already supports `podman volume create`, though it doesn't support volume plugins.

Docker has been supporting rootless mode since 19.03

VPN-ish proxy that seamlessly brings clients into remote Docker/Kubernetes networks. No public IP is required. No privilege is required. The only requirement is shell accessibility (`docker exec`, `kubectl exec`).

- GitHub: https://github.com/norouter/norouter

- Document: https://norouter.io/docs/getting-started/vpn

- Screenshot (macOS connected to a remote rootless Podman CNI network): https://twitter.com/_AkihiroSuda_/status/1327118992784437248

> Why can't you update the Docker image to also support ARM? You theoretically could switch your backend to run ARM Linux. However, this would take months

No need to take months. `docker buildx` can build multi-arch images without using real ARM instances.

> The downside is that V2 doesn’t support all the controllers that were implemented for cgroups V1 (e.g. devices, net_cls, net_prio,etc.).

device controller is present since kernel 4.15.

> Adoption status

Docker/Moby supports FUSE-OverlayFS and cgroup2 as well on master. Planned to be released as v20.0X.

> spearheaded by Podman and LXC.

Yes w.r.t. cgroup, but the network stuffs (slirp4netns & RootlessKit) were originally written for Docker/Moby :)

> the truth is that container engines run Slirp without the seccomp support

Untrue. https://github.com/containers/libpod/blob/d4a3c05c0fcd0c53fa... https://github.com/moby/moby/blob/b47e74255811b2ead92b222541...

"guiTAR is a generic archive tool, written in GTK+/Gnome, supporting plain tarballs, tar.gz, tar.bz2, slp, zip, lzh, arj, and rar format. "

https://www.freshports.org/sysutils/guitar/

http://web.archive.org/web/20020401054755/http://artemis.efe...

Look forward to 5G :)

I agree that the phone should be encrypted (in conjunction with aind), but people are likely to set weak passcode like "1234" (or finger pattern) because they want to open email/phone/twitter/maps/payment apps in a few seconds.

aind is expected to be used only for sensitive apps, with more strong passcode.

overlayfs isn't necessary either :)

Anbox is for desktop, aind is for cloud (and edge).

The biggest advantage of running Android on cloud/edge I think is anti-theft.

Also, it will be soon able to run multiple aind pods on Kubernetes with distinct UID mappings. (I need to submit patches to Anbox upstream)

Not always true since Docker 19.03: https://docs.docker.com/engine/security/rootless/

Probably aind doesn't work with rootless Docker currently mostly because of squashfs stuff, but I believe we can workaround that relatively easily.

I haven't tested, but if UI automator stuff works with Anbox, it should work with aind as well.

I can add it to the scope of the project if it works.

The author of aind is here.

--privileged is required for nesting an Anbox (LXC) inside Docker. But you don't need to worry too much because Anbox launches "unprivileged" LXC using user namespaces. You can confirm that all Android process are running as non-root users by executing `docker exec aind ps -ef`.

slirp4netns v0.2.3, v0.3.2, and v0.4.0-beta.3 are already patched for this CVE.

https://github.com/rootless-containers/slirp4netns/security/...

Also, v0.4.0-beta.2+ can harden its own process by unsharing mount namespace and pivotting_root to an empty dir that only contains /etc and /run with noexec mount option. v0.4.0-beta.4+ additionally supports seccomp filters.