LXD Based Container For Desktop Applications - Some Success - Help (need more)

[redger]

thx for the info - Qubes looks interesting. When I set all this up I referred primarily to EAL security ratings ... which led me to KVM (preferably via RedHat / Centos) .... and then Ubuntu since I had previously been a little frustrated with Red Hats offerings.
https://en.wikipedia.org/wiki/Evalua...ssurance_Level

I have stayed with KVM-QEMU for security and "real" isolation. As Fu says, everything has its issues - this is essentially a constantly evolving predator-prey ecosystem (or parasitism if you prefer) so the balance is always changing (have a look at recent advances in machine learning based security if you want some sleepless nights).
http://www.bbc.com/news/technology-36980307 (turn this around and consider malevolent hackers using the same/similar techniques)

At the end of the day Intel and AMD have already installed root kits on every PC and there's nothing we can do about that ... we're all open to state sponsored intrusion and surveillance with no real alternative. And I'm not THAT paranoid (I don't have razor wire and total camera surveillance to exclude physical intrusion either )
https://libreboot.org/faq.html#intel


In my case I'm happy with the degree of isolation provided for LXC/LXD for most of my processing it offers many of the advantages of security thru separation without the overheads of full virtualisation ... and it's operationally "easy" which is worth a lot (mine is just a home processing environment).
Worth noting also that i don't worry too much about full application isolation (that's a Docker style approach) either, not too big a deal for me. Don't let "perfect" obstruct "good enough" ... my comparator is an "normal desktop" rather than a military grade server or commercial hosting service

This 2012 Los Alamos paper is worth reading (for anyone stumbling on this discussion) ... a bit old perhaps ... still http://permalink.lanl.gov/object/tr?...LA-UR-12-25508

[KillerKelvUK]

So got the audio working, again minor adaptation from the guide, maybe obvious points but new packages to me...

Set paprefs on the host but needed to logout/login to get the tcp port listening.
Inside the container I needed to install the pulseaudio package which isn't mentioned.

Only stability issue I have so far isn't with the container but with conky on my host. It craps out completely when I run certain lxc commands which is really odd, its stable 100% of the time when I'm not using LXD.

[KillerKelvUK]

Well redger I'd say its pretty stable, just been playing Half Life for quite sometime and no hiccups whatsoever.

[redger]

bewdy ... just the ticket.

Thanks for following through

[DuckHook]

Bumping a very useful thread to keep it relevant.

[simosx]

Bumping a very useful thread to keep it relevant.

Just found out about this thread.

I have written a guide at https://blog.simos.info/how-to-run-g...buntu-desktop/
on how to get GUI apps on the host X server (graphics acceleration and audio support).
You can run apps like browsers (Firefox, Chrome), Wine and Steam (counterstrike, etc).

If you use Wayland, make sure you have installed xwayland.

[TheFu]

Are there known security issues with allowing containers access to the host's audio, video, and clipboard devices? How do we lock those down as much as possible?

Can someone compare using LXD to Firejail or mbox?

I use firejail both with a tmpfs overlay and just restrictions to subdirs under HOME for write. It is really, really, easy. Very lite. Haven't tried wayland - ever.

Anyways, all of this is great even if nothing is perfect, each is a step in the right direction to lock down risky processes just a little more than before. Golf claps all around! Very nice.

[DuckHook]

I have written a guide at https://blog.simos.info/how-to-run-g...buntu-desktop/
on how to get GUI apps on the host X server (graphics acceleration and audio support).
You can run apps like browsers (Firefox, Chrome), Wine and Steam (counterstrike, etc).

If you use Wayland, make sure you have installed xwayland.

Thank you so much for your guide, simosx. redger had already linked to it above and, indeed, it is the main reason that I bumped this thread.

It's a pleasure to have you on the forums.

[simosx]

Are there known security issues with allowing containers access to the host's audio, video, and clipboard devices? How do we lock those down as much as possible?

Can someone compare using LXD to Firejail or mbox?

I use firejail both with a tmpfs overlay and just restrictions to subdirs under HOME for write. It is really, really, easy. Very lite. Haven't tried wayland - ever.

Anyways, all of this is great even if nothing is perfect, each is a step in the right direction to lock down risky processes just a little more than before. Golf claps all around! Very nice.

I tried all three of them. They all use the same Linux kernel security features to enforce the separation of processes. The main difference for me is in the usability to the end-user.

LXD is similar to Docker/Moby in that both are about containers. LXD differs from Docker/Moby in that it offers machine containers. That is, it's containers that behave just like additional servers/computers, inside your computer.
The purpose of LXD is to be a very light-weight KVM or Virtualbox. I am running now ten LXD machine containers on my desktop and they do not cause any degradation in performance.

LXD is meant to be used for services (servers), but it can be used for GUI apps as well.
My tutorial to get GUI apps on LXD is at https://blog.simos.info/how-to-run-g...buntu-desktop/
This tutorial tries to be simple, and re-uses the desktop X session (GPU and Pulseaudio server). It does not offer security separation over the low-level desktop X session. For security separation, it would need to use Xephyr instead.

Here are some use-cases for using LXD with GUI apps:

1. You want to install an app in Wine, but you do not want to mess with your desktop by installing all those 32-bit dependencies and what not. You install Wine in a LXD container instead.

2. You want to install Steam, and again do not want to mess with 32-bit packages and other stuff that get installed. You then have 2+ steam accounts and want an easy way to switch from one to the other. You just make a copy of the container and set up the new account.

3. You want to try a nodejs app (an example without GUI) but do not want to install all sort of dependencies. You install it in a LXD machine container and access over HTTP. For example, https://blog.simos.info/how-to-insta...lxd-container/ This provides good security separation.

Compared to mbox, here is how to do this with LXD,

$ lxc launch ubuntu:16.04 mytest
Creating mytest
Starting mytest

$ lxc exec mytest /bin/bash
root@mytest:~# cd /
root@mytest:/# ls
bin   dev  home  lib64  mnt  proc  run   snap  sys  usr
boot  etc  lib   media  opt  root  sbin  srv   tmp  var
root@mytest:/# rm -fr *
root@mytest:/# ls
bash: /bin/ls: No such file or directory
root@mytest:/# echo *
dev proc run sys var
root@mytest:/# exit

$ lxc stop --force mytest
$ lxc delete mytest
$

In this example, we created a machine container called mytest with a brand-new and clean Ubuntu 16.04 installation. Then, we invoked a root shell in mytest. The next step was to rm -fr all files. Being a machine container, we only removed files inside the machine container.
We then exit the machine container, and we force-stop it. Finally, we delete "mytest" and that's it. All gone!

Here is the list of Linux distributions that are supported (as "guests") in LXD machine containers, https://us.images.linuxcontainers.org/

Overall, the main benefit of LXD to me is that it is simpler to use and you are less likely to make a mistake when using it.
For even easier GUI on LXD with proper X11 separation, it should be possible to take the code of Xephyr and create a lightweight clone of Virtualbox!

[TheFu]

For complex dependencies, I understand why a container/VM would be useful. Same for applications that cannot be installed outside the default locations in an OS. That fits most webapp needs. Since I don't game or use WINE (anymore), the other examples don't mean much to me. It is easier to just keep 1 Win7 VM around for those Windows tools I haven't found replacements for, yet.

BTW, you showed lxc, not lxd in the commands. Was that intentional?

$ firejail --private /path/to/thunderbird

is pretty easy. However, that isn't too useful with an email program - even with IMAP servers. I haven't played with any webapps and firejail. I'm a perl webapp dev. Shouldn't be too hard, since they all run in a self-contained area (including their own perl) and only use tcp connections between their cluster servers and the reverse proxy.

Good discussion. Appreciated.