{"id":19398072,"url":"https://github.com/arthurweinmann/experiment-process-containers","last_synced_at":"2026-06-17T15:34:13.497Z","repository":{"id":187329006,"uuid":"676714533","full_name":"arthurweinmann/experiment-process-containers","owner":"arthurweinmann","description":":warning: OLD EXPERIMENT I used to learn Rust and linux namespaces :warning: A port of the excellent process isolation library NsJail to rust with experimental features to decrease the startup latency further","archived":false,"fork":false,"pushed_at":"2023-08-09T21:10:48.000Z","size":265,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-03-03T23:23:46.012Z","etag":null,"topics":["containers","linux-namespaces","nsjail","process-isolation","rust"],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/arthurweinmann.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2023-08-09T20:53:21.000Z","updated_at":"2023-08-09T21:13:33.000Z","dependencies_parsed_at":"2023-08-09T22:44:22.124Z","dependency_job_id":null,"html_url":"https://github.com/arthurweinmann/experiment-process-containers","commit_stats":null,"previous_names":["arthurweinmann/experiment-process-containers"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/arthurweinmann/experiment-process-containers","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/arthurweinmann%2Fexperiment-process-containers","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/arthurweinmann%2Fexperiment-process-containers/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/arthurweinmann%2Fexperiment-process-containers/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/arthurweinmann%2Fexperiment-process-containers/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/arthurweinmann","download_url":"https://codeload.github.com/arthurweinmann/experiment-process-containers/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/arthurweinmann%2Fexperiment-process-containers/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":284902577,"owners_count":27081908,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-11-17T02:00:06.431Z","response_time":55,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["containers","linux-namespaces","nsjail","process-isolation","rust"],"created_at":"2024-11-10T11:04:48.665Z","updated_at":"2025-11-17T15:04:23.393Z","avatar_url":"https://github.com/arthurweinmann.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# DISCLAIMER: THIS IS AN OLD EXPERIMENT MADE PUBLIC\n\nThis repository contains an old experiment of mine, so it should not be used as is and probably won't work.\nNevertheless, it may give you some useful information. \n\nI used it as a way to learn Rust too so it is not very pretty and contains a lot of notes about Rust behaviours and syntax.\nAlso the version of Rust used is quite old now.\n\nWith all that said, enjoy!\n\nIt is mainly a port in Rust of the excellent project: https://github.com/google/nsjail\n\n# Usage\n\n## Interactively build rootfs image\n\n- Compile toastainer\n- then run the binary with command line argument --create_image={absolute path to rootfs directory}, like:\n\n```bash\n./rust/toastainer/target/debug/toastainer --create_image=/home/arthurbuntu/alpine\n```\n\n- If you want to use a shell script, do:\n\n```bash\n./rust/toastainer/target/debug/toastainer --create_image=/home/arthurbuntu/alpine --use_script={absolute path to sh script}\n\n# like\n\n./rust/toastainer/target/debug/toastainer --create_image=/home/arthurbuntu/alpine --use_script=/home/arthurbuntu/rust/toastainer/rootfs/src/test.sh\n```\n\n# Installation\n\n- steps for ubuntu 18.04. Todo: see how to make it work on other distrib, like debian for example.\n\n## libnl\n\nIf command ```pkg-config --exists libnl-route-3.0 \u0026\u0026 echo yes``` does not echo \"yes\", you probably miss libnl3(-dev)/libnl-route-3(-dev) libraries\n\nOn ubuntu 18.04, install with:\n\n```\nsudo apt-get install libnl-3-dev\nsudo apt-get install libnl-route-3-dev\n```\n\n\u003e It should put the lib (at least its headers) in /usr/include/libnl3.\n\n\u003e To check which version is currently installed, you can use `cat /usr/include/libnl3/netlink/version.h`.\n\n## libcap\n\nUsed in caps package\n\n`sudo apt-get install libcap-dev`\n\n## newuidmap and newgidmap\n\nif `which newuidmap` and/or `which newgidmap` prints nothing, then you need to install them with `sudo apt install uidmap`.\nThey should go in /usr/bin/newuidmap and /usr/bin/newgidmap\n\n## Network Setup\n\n```bash\nip link add dev tveth0 type veth peer name tveth1\nip link set dev tveth0 up\nip link set dev tveth1 up\nip addr add 10.166.0.1/16 broadcast 10.166.255.255 dev tveth0 # 10.0.0.0/8 is by convention a block of private IP addresses, See http://www.faqs.org/rfcs/rfc1918.html\n\n# On your local PC only\niptables -t nat -A POSTROUTING -s 10.166.0.0/16 -j MASQUERADE\n\n# on TVS only,  do not do this on your PC, it is to prevent Toaster from calling private toaster servers in aws VPC\n# iptables -t nat -A POSTROUTING -s 10.166.0.0/16 ! -d 172.16.0.0/12 -j MASQUERADE\n\necho 'net.ipv4.ip_forward=1' \u003e\u003e /etc/sysctl.conf\nsysctl -p /etc/sysctl.conf\n\n# it is tveth1 that will be moved into the child NET namespace\n\n# without one of these line, toaster/container/child in new net namespace, won't be able to resolve hostnames to ip addresses\n# echo \"nameserver 8.8.8.8\" \u003e /chroot/binary/etc/resolv.conf # with a rootfs\n# echo \"nameserver 8.8.8.8\" \u003e /etc/resolv.conf # with native root (no pivot root done)\n```\n\n***See jail/src/net.md for more information***\n\n# Inspiration\n\n## NSJail (C++)\n\n## Firecracker (rust)\n\n## Moby by Docker (golang)\n\n- https://github.com/moby/moby\n\n# Notes\n\nThings still to learn and apply to this package:\n\n- rust async/.await: zero-cost pollable async computation (futures): https://rust-lang.github.io/async-book/01_getting_started/01_chapter.html\n- rust PIN: a type that pins data to its location in memory, useful for example for self-referential structs: https://doc.rust-lang.org/std/pin/\n- rust std::ptr::NonNull: https://doc.rust-lang.org/std/ptr/struct.NonNull.html#method.dangling\n- rust marker: Primitive traits and types representing basic properties of types. For example, PhantomData (Zero-sized type used to mark things that \"act like\" they own a T) or PhantomPinned\t(A marker type which does not implement Unpin): https://doc.rust-lang.org/nightly/std/marker/index.html\n- std::cell: https://doc.rust-lang.org/std/cell/index.html and especially UnsafeCell: https://doc.rust-lang.org/std/cell/struct.UnsafeCell.html. Can be used for example when Rust compiler complains about a mutex and you know for example that you only have one thread and actually do not need it.\n\n## For a TCP server with linux epoll and rust async/.await\n\n- https://github.com/Hexilee/async-io-demo: demo for rust asynchronous io: from mio to stackless coroutine\n\n- check out https://github.com/tokio-rs/tokio if it really uses stackless coroutine with epoll and rust futures\n\n- https://github.com/murphysean/betarustasyncawait\n\n# GPU support\n\n- https://lwn.net/Articles/788277/\n- https://marmelab.com/blog/2018/03/21/using-nvidia-gpu-within-docker-container.html\n- https://github.com/google/cadvisor/blob/master/docs/running.md#hardware-accelerator-monitoring\n- https://github.com/firecracker-microvm/firecracker/issues/849\n- https://www.phoronix.com/scan.php?page=news_item\u0026px=Linux-Cgroups-GPUs-2019\n- https://discuss.linuxcontainers.org/t/gpu-resources-monitoring-for-lxd-containers/5365/2\n- https://stgraber.org/2017/03/21/cuda-in-lxd/\n- https://marmelab.com/blog/2018/03/21/using-nvidia-gpu-within-docker-container.html\n\n# Read List\n\n- https://utcc.utoronto.ca/~cks/space/blog/unix/ChownDivideAndQuotas\n- https://utcc.utoronto.ca/~cks/space/blog/sysadmin/ChownSymlinkSafetyII\n- https://utcc.utoronto.ca/~cks/space/blog/\n\n- Nice mini container summary: https://zserge.com/posts/containers/\n\n# Tricks\n\n## Bash\n\n### Print process namespaces\n\n```bash\nls -l /proc/$$/ns | awk '{print $1, $9, $10, $11}'\n```","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Farthurweinmann%2Fexperiment-process-containers","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Farthurweinmann%2Fexperiment-process-containers","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Farthurweinmann%2Fexperiment-process-containers/lists"}