F45 Change Proposal: Encapsule isolated devel containers (self-contained)

Wiki - https://fedoraproject.org/wiki/Changes/Encapsule_devel_containers Discussion thread - https://discussion.fedoraproject.org/t/f45-change-proposal-encapsule-isolated-devel-containers-self-contained/197423 This is a proposed Change for Fedora Linux. This document represents a proposed Change. As part of the Changes process, proposals are publicly announced in order to receive community feedback. This proposal will only be implemented if approved by the Fedora Engineering Steering Committee. == Summary == [https://github.com/juhp/encapsule encapsule] is a new small CLI tool for developers who want to try out "tools installed from the internet" for example (or use them within a project workdir) inside a safer container environment rather than directly in their home directory and host system. == Owner == * Name: [[User:Petersen|Jens Petersen]] * Email: <petersen@redhat.com> == Detailed Description == The CLI tool allows running developer containers, isolating your home directory and host from container side effects: it can "encapsule" a project and/or temp homedir there together with select enabled "capabilities". It uses Podman to run a (derived) container image (which can be generated by Buildah from a toolbox container say). The project [https://github.com/juhp/encapsule#readme readme] file has more details about the specific features and commandline options. In this age developers are frequently asked to install and run all kind of commands or software directly from the internet whether from source or more often now binaries. In recent years `curl https://some.project/install.sh | bash` or `npm/npx install ...` (and many others: pip, cargo, etc) are being normalized and can both pollute one's home directory or system, and also put it at increased security risk. `encapsule` provides a lightweight, somewhat safer environment for installing and running such tools. Note however it is ''not'' intended for running known malicious programs or security testing, etc - though at least it provides some basic separation or system hygiene. Users can also disable sudo or even the network (or potentially DNS) inside the encapsule container. In many ways it makes opposite design choices to toolbox: closed by default rather than open - but one can opt in to sharing specific things from the host. A lot of the original ideas are derived from [https://github.com/swick/toolbox-constrained/ toolbox-constrained] by Sebastian Wick, without which this tool probably wouldn't exist now in its current form. For more hardened isolation it is recommended to look at OpenShell though it is not available yet in Fedora. In the future it may be possible to migrate `encapsule` to wrap `openshell` for instance and use its gateway perhaps, which would enhance network isolation considerably. The alternative is to use a VM of course, but that is much more heavyweight and awkward: though there is the similar [https://github.com/whot/schupfn whot/schupfn] project, which allows exporting specified directories with 9p to a QEMU VM instance, also generated from a toolbox. == Feedback == == Benefit to Fedora == Fedora users will have a simple way to isolate toolbox containers etc from their homedir and host system for running third party tools inside a contained environment, where they control what is shared from their home or host system. == Scope == * Proposal owners: ** Submit `encapsule` for package review and get it approved ** Fix reported issues and improve further * Other developers: N/A * Release engineering: [https://forge.fedoraproject.org/releng/tickets/issues #Releng issue number] * Policies and guidelines: N/A (not needed for this Change) * Trademark approval: N/A (not needed for this Change) * Alignment with the Fedora Strategy: == Upgrade/compatibility impact == N/A == Early Testing (Optional) == https://copr.fedorainfracloud.org/coprs/petersen/encapsule/ == How To Test == * `sudo dnf install encapsule` * `encapsule --help` * `encapsule fedora-toolbox:44 -p myproject` * `encapsule fedora-toolbox-44 --home tmphome` * https://github.com/juhp/encapsule#examples == User Experience == Users will have a safer way to run harnesses and other tools grabbed from the internet. == Dependencies == == Contingency Plan == * Contingency mechanism: (What to do? Who will do it?) N/A (not a System Wide Change) * Contingency deadline: N/A (not a System Wide Change) * Blocks release? N/A (not a System Wide Change) == Documentation == N/A (not a System Wide Change) == Release Notes == To be written -- Aoife Moloney Fedora Operations Architect Fedora Project Matrix: @amoloney:fedora.im IRC: amoloney -- _______________________________________________ devel-announce mailing list -- devel-announce@lists.fedoraproject.org To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new