--disable_clone_newuser ignored about nsjail HOT 3 CLOSED

I ended up doing this

nsjail -Mo \
--rlimit_as 700 \
--chroot / \
-E LANG=en_US.UTF-8 \
-R/usr -R/lib -R/lib64 \
--user nobody \
--group nogroup \
--time_limit 2 \
--disable_proc \
--iface_no_lo \
--quiet -- /usr/local/bin/python3.6 -ISq -c "print('test')"

and run the docker container in privileged mode

from nsjail.

Using --chroot / and -R /usr duplicates itself, as-in, both / will be mounted RO, and /usr will be mounted RO. But /usr would be there anyway as it's part of /. Try without --chroot /. Like this

nsjail -Mo --rlimit_as 700 -E LANG=en_US.UTF-8 -R/usr -R/lib -R/lib64 --user nobody --group nogroup --time_limit 2 --disable_proc --iface_no_lo --quiet -- /usr/bin/python3.6 -ISq -c "print('test')"

As for --disable_clone_newuser, it requires running nsjail from root (man user_namespaces for CLONE_NEWUSER)

from nsjail.

Aha! Thank you 👍

from nsjail.