Sharing host pid with incus

Incus
,
1

Hello to the community, thanks by advance.

I am playing around ‘basic’ container security and I manage to build everything I wanted with incus only for one case.

I would like to build a container either lxc or oci, (i have tried both without success) with shared host pid and user namespace with CAP_SYS_PTRACE. The goal is to create a lab for students.

With docker is quite an easy cli flag, however I really want to use incus that’s why I’m here.

Also I am not sure if it is possible with system containers without tricking the init system, I did not manage to get rid of the init error with debian.
For OCI containers I’ve tried to modify manually config.json to get rid of namespaces I do not want to clone and adding the SYS_PTRACE capability. However it do not seems to be applied when only modifying config.json, so I tried to give lxc.raw values but this have’nt work too.

I am asking if there is a known limitation with incus on sharing PID ns with host ? Also if someone can disgress about the config.json and the correct way of configuring oci containers with incus, it seems to be read at each start of container but I was not able to see changes after modification…

If there is a known need for peculiar modifications and support I would be happy to contribute!

Thanks to everyone!

2

EDIT

I managed to find a solution for OCI containers, using bash container for testing.

Using raw.lxc = "lxc.namespace.clone net uts ipc mnt cgroup"

Still if someone is knowledgeable about the use of config.json, I am interested. I found the file is used by internal/config.go and looked quickly, I did not understand how / if values are reloaded if the file is changed or only parsed first at instance creation? Sorry I am learning go…

I’ll keep trying to get it work on system containers (perhaps it is again a something that i forgot) and update the thread accordingly.