Implement containerization from scratch

[vadorovsky]

Drop the dependency on container engines like Docker or Podman by using unshare syscall to implement rootless containers, oci-spec crate toread OCI image specifications, reqwest and tar-rs to download the images. This way, we can keep all the container logic in our binary.

That solves the major problem we had with Docker - file ownership in bind mounted volumes - where new files created inside container in a volume with source code were owned by root and therefore inaccessible for a regular user calling icedragon.

After this change, regular container engines are still used for building the images.

Fixes #7

---

This change is 

[vadorovsky]

Of course hitting an issue reproducible only on Github Actions 😭

[ERROR libcontainer::namespaces] failed to unshare namespace err=Nix(EPERM) namespace=LinuxNamespace { typ: Pid, path: None }
[ERROR libcontainer::process::container_main_process] failed to run intermediate process EPERM: Operation not permitted
[ERROR libcontainer::container::builder_impl] failed to run container process intermediate process error EPERM: Operation not permitted
[WARN  libcgroups::common] cannot configure rootless cgroup using the cgroupfs manager

thread 'tokio-runtime-worker' panicked at src/main.rs:627:18:
called `Result::unwrap()` on an `Err` value: CreateContainerError(CreateContainerError(MainProcess(Channel(OtherError("EPERM: Operation not permitted"))), None))

Rootless podman works fine, so either:

• Podman just skips the namespace-related errors (if that's the case, we should too).
• nix does something weird when unsharing the pidns (unlikely, it looks like pure unshare(pid))

[vadorovsky]

OK, it's AppArmor.

sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0

is a sufficient workaround. Will think of something better, but I might stick to it if I'm out of options.

[Copilot]

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

[tamird]

Reviewed 1 of 1 files at r2.
Reviewable status: 1 of 4 files reviewed, 2 unresolved discussions (waiting on @copilot-pull-request-reviewer[bot])

---

Cargo.toml line 33 at r2 (raw file):

oci-client = { version = "0.14", default-features = false, features = ["rustls-tls"] }
# libcontainer fails to build with newer versions. Not a direct dependency of
# icedragon.

link to a bug?

---

Cargo.toml line 56 at r2 (raw file):

# https://github.com/youki-dev/youki/issues/3144
# https://github.com/youki-dev/youki/pull/3146
libcontainer = { git = "https://github.com/vadorovsky/youki", branch = "cgroupfs-rootless-warning" }

this should probably wait until these are resolved in some way?

[vadorovsky]

Reviewable status: 1 of 4 files reviewed, 2 unresolved discussions (waiting on @copilot-pull-request-reviewer[bot] and @tamird)

---

Cargo.toml line 33 at r2 (raw file):

Previously, tamird (Tamir Duberstein) wrote…

link to a bug?

Good call, I didn't make one before:

checkpoint-restore/rust-criu#25

---

Cargo.toml line 56 at r2 (raw file):

Previously, tamird (Tamir Duberstein) wrote…

this should probably wait until these are resolved in some way?

Might take very long, given no response.

Actually, given that working with youki crates turns out to be a bit annoying, I might try going even deeper and creating a "container" by issuing bunch of unshare syscalls myself, avoiding to use these deps. I will give it a though today and if I get convinced that's not too crazy, I will do that.

To be precise, the annoying things are:

• Hard dependency on systemd.
• The protobuf issue.
• Lack of possibility to pass a Spec without saving it on disk.

[vadorovsky]

Reviewable status: 1 of 4 files reviewed, 2 unresolved discussions (waiting on @copilot-pull-request-reviewer[bot] and @tamird)

---

Cargo.toml line 56 at r2 (raw file):

Previously, vadorovsky (Michal Rostecki) wrote…

Might take very long, given no response.

Actually, given that working with youki crates turns out to be a bit annoying, I might try going even deeper and creating a "container" by issuing bunch of unshare syscalls myself, avoiding to use these deps. I will give it a though today and if I get convinced that's not too crazy, I will do that.

To be precise, the annoying things are:

• Hard dependency on systemd.
• The protobuf issue.
• Lack of possibility to pass a Spec without saving it on disk.

I managed to get rid of youki/libcontainer and do everything with mount and unshare through nix! \o/

Going zzz now. My last push will be most likely red, I will polish it tomorrow.