disposable rootless sessions

would be nice to have a way to “fork” the current session and be able to revert all the changes done, without any leftover on the file system.

Playing with fuse-overlayfs, a FUSE implementation of the overlay file system and thus usable by rootless users, I realized how that is so easy to achieve, just by setting the overlay lowerdir to ‘/’ and using a temporary directory for the upper dir.

The upper dir, where all the overlay changes are written can be deleted once the session is over, or re-used to get back the created session.

This simple setup also enables the use case of an unprivileged user that can install packages using the existing system as a base. With few caveats (e.g. /var/log must be writeable) I managed to run dnf and install a few packages on top of my system without the need of the root user. Obviously the rest of the system didn’t notice any change, as these files were visible only from the fuse-overlayfs mount and the mount namespace using it.

Perhaps a tool could help managing similar setups. The biggest problem is in how to address the assumption the lower layer won’t change, or at least not enough to cause any breakage in the layered session.

2 thoughts on “disposable rootless sessions”

  1. Hi,
    Super interesting idea, this could mean running an image_x in my GitLab pipeline, create fuse-overlayfs from / and upperdir a tmpfs and use my registry_push –from_image=image_x –rootfs=tmps –image=image_y
    especially interesting to add a few rpm’s to an existing image for my gitlab-runner that I build for openshift. (https://gitlab.com/gioxa/odagrun/odagrun)

    would like to experiment with this, could you elaborate how you added a temporary directory as upperdir? would that temporary directory then also not be part of the lowerdir?

  2. yes, unfortunately I needed to use an upperdir that was also visible from the lowerdir ‘/’.

    To avoid loops, I’ve then covered the lowerdir path with a tmpfs, e.g.

    fuse-overlayfs -o lowerdir=/,upperdir=/var/tmp/session/upperdir,workdir=/var/tmp/session/workdir /var/tmp/session/merged

    On top of that:

    mount -t tmpfs tmpfs /var/tmp/session

Leave a Reply

Your email address will not be published. Required fields are marked *

25 − sixteen =