dockerTools - how to create image with setuid binary?

Help
1

Is there any example or documentation on how to get working setuid binaries in a container built using dockerTools.buildLayeredImage? (assume that default user in the container cannot be root)

It looks like wrappers require nixos system (not a container built using dockerTools), and most searches lead to a stale issue suid wrapper architecture should be documented · Issue #154128 · NixOS/nixpkgs · GitHub .

Working inside a podman container (build by dockerTools.buildLayeredImage), my goal is to build another container image (using dockerTools.buildLayeredImage, this seems to work) and run the newly built container using podman (while already running inside the original container). Basically inside a container verify that the newly build image correctly starts as a (nested) container - i.e. no missing dependencies or data files, etc…

It looks like containers built using dockerTools.buildLayeredImage do not have any support for setuid binaries (not even sudo/su), and nixos/modules/security/wrappers/default.nix requires full nixos system with systemd.

At the moment the path to working setuid binaries in nix-based podman container seems to be through creating a systemd-based nixos container (LXC), somehow making sure that bash starts on console, and converting it to something runnable by podman. That does not seem like the correct way.

Am I missing something obvious?

2

To add the setuid bit on a file in a container, I think you could use the `buildImage.runAsRoot`parameter (I don’t know this part and I could be wrong, but that could also be possible with the buildImage fakeroot feature).

You could also use nix2container which allows to set the mode on some specific files. See the perms parameters in GitHub - nlewo/nix2container: An archive-less dockerTools.buildImage implementation · GitHub .

3

You have written a lot of text explaining that you use nested podman, but not explained why you actually need SUID.

So could you explain that part? Or at least tell us what errors you get with your current approach?

4

Podman requires newuidmap and newgidmap binaries to work, and those binaries must have setuid bit set to actually work. Therefore, working podman command inside a container requires a setuid binary inside the container. (assuming the primary user in the container is not ‘root’)

An (outer) podman container is started in a ‘work’ directory, which is made accessible to the container (podman --rm -it -v "$(pwd):/home/containeruser/work" --userns=keep-id:uid=1000,gid=1000 ...). bash inside the container is running as non-root (uid=1000(containeruser) gid=1000(containeruser) groups=1000(containeruser)).

(the idea is to start an on-demand container to work on a project as a normal user, just in a bit sandboxed environment)

Thanks to the fakeroot recommendation, following method to set setuid bit on newuidmap and newgidmap using dockerTools.buildLayeredImageWithNixDb seems to work:

  1. In contents cp newuidmap and newgidmap to /run/wrappers/temp
  2. In fakeRootCommands, /run/wrappers/temp contents are now symlinks to nix store, mkdir /run/wrappers/bin and copy the targets there, and chmod them there.

Resulting image has newuidmap and newgidmap binaries with setuid bit set.
(running newuidmap inside the container still fails, but now with newuidmap: write to uid_map failed: Operation not permitted, likely /etc/subuid or outer podman configration issue…)

(btw. sudo/su with setuid bit by default do not work inside the container - there is nothing generating PAM configuration. It looks that for podman containers, there really is nothing similar to NixOS configration modules)