21 unstable releases (5 breaking)

0.5.1 Oct 11, 2018
0.4.0 Jul 23, 2018
0.2.0 Aug 25, 2017
0.1.15 Dec 15, 2016
0.1.4 Nov 12, 2015

#127 in Unix APIs

Download history 17/week @ 2019-11-30 161/week @ 2019-12-07 13/week @ 2019-12-14 1/week @ 2019-12-21 22/week @ 2019-12-28 2/week @ 2020-01-04 31/week @ 2020-01-11 25/week @ 2020-01-18 7/week @ 2020-01-25 8/week @ 2020-02-01 40/week @ 2020-02-08 2/week @ 2020-02-15 112/week @ 2020-02-22 26/week @ 2020-02-29 48/week @ 2020-03-07 45/week @ 2020-03-14

219 downloads per month
Used in 5 crates

MIT/Apache

95KB
2K SLoC

Rust Unshare

Status: 90% feature-complete, works in production in lithos and powers vagga

Github | Documentaion | Crate

Unshare is a low-level library to create linux containers.

It contains the following:

  • Process creation interface similar to std::process::Command
  • Unsharing arbitrary linux namespaces
  • Ability to change root (chroot/pivot_root), uid, gid, gid_map
  • Some signal mask handling (especially for new processes)
  • Forwarding file descriptors and other unixy stuff (sessions, terminals)
  • Setting few important prctl flags (PR_SET_PDEATHSIG)
  • Runs both as root user and as unprivileged user

Not implemeneted yet:

  • Fine grained capabilities control (currently you may change user or use user namespaces)

The following is considered:

  • Capture input (should be, because part of std::process interface)
  • Pseudo tty creation for child
  • The unshare and setns

The following is out of scope:

  • mounting file systems
  • setting up network
  • in-container and out of container supervision
  • handing child signals

License

Licensed under either of

at your option.

Contribution

Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.

Dependencies

~1MB
~19K SLoC