rbalman / ship

bare minimal shell based container runtime, inspired from https://github.com/p8952/bocker/blob/master/bocker

Bare minimum shell based container run time built just for fun. ⚠️ Not a production grade tool in any ways.

Features

• Run the container using exported filesystem
• Exec inside the container
• Remove container
• List the containers

Limitations

• Containers run in the foreground mode only.
• No log tailing support.
• Containers networking doesn't work by default.
• Containers Security and Capabilities are not supported.
• Layer Fileystem is not supported.

Installation

System requirements

• libcgroup-tools

sudo curl -o /usr/bin/ship https://raw.githubusercontent.com/rbalman/ship/main/ship.sh

Available Commands

Commands:
  run <root_fs_path> [<command>]    Run a new container
  exec <container_id> <command>     Execute a command inside a running container
  rm <container_id>                 Remove a container
  ps                                List all running containers

Examples

• Download the file system

mkdir alpine-fs
curl -o alpine-fs/alpine-rootfs.tar.gz https://dl-cdn.alpinelinux.org/alpine/v3.19/releases/x86_64/alpine-minirootfs-3.19.1-x86_64.tar.gz
tar -xvf alpine-fs/alpine-rootfs.tar.gz -C alpine-fs/

Running Container

  vagrant@vagrant:~$ sudo ship run ${PWD}/alpine-fs /bin/sh
  Running Container: 1920f52b6cd8 from image /var/lib/ship/1920f52b6cd8/root...
  / # apk --version
  apk-tools 2.14.0, compiled for x86_64.
  / # ps -ef
  PID   USER     TIME  COMMAND
      1 root      0:00 /bin/sh
      4 root      0:00 ps -ef
  / # ip link
  1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN qlen 1000
      link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    sudo ship stop 1920f52b6cd8

Exec Container

  vagrant@vagrant:/vagrant$ sudo ship exec 1920f52b6cd8 /bin/sh
  / # apk --version
  apk-tools 2.14.0, compiled for x86_64.
  / # ps -ef
  PID   USER     TIME  COMMAND
      1 root      0:00 /bin/sh
      7 root      0:00 /bin/sh
      9 root      0:00 ps -ef
  / # 

List Containers

vagrant@vagrant:/vagrant$ ship ps
CONTAINER_ID         CONTAINER_IMAGE     
1920f52b6cd8         /var/lib/ship/1920f52b6cd8/root

Stop Container

vagrant@vagrant:/vagrant$ sudo ship rm 1920f52b6cd8
killing container process with pids: 12483

vagrant@vagrant:/vagrant$ sudo ship ps
CONTAINER_ID         CONTAINER_IMAGE  

ship's Issues

Grep returns error when removing containers

Probelm

I got an error from grep command while removing the container with ship.

grep: warning: stray \ before white space

Also, for some of the command if root access is required then it didn't mention that.

Add: Automated Testing for each sub command for smoothing contribution

Currently, there no automated testing so, every time there is any change. Reviewer or Tester must:

• clone the latest change
• test each subcommand
• publishes the results as screenshots for feedback or proof

This process is manual, error prone and time consuming so, it might lead to bad practices or laziness. So adding automated testing would help introduce efficiency.

Feature: Add/Discuss the capability to move the containerized process in the background

Currently, ship containers only run in the foreground, It would be nice to have them run in a daemon mode. When moving the container to the background its logs also needs to be persisted in designated path.

Current Scenario:

If you look at the script where container is run, it doesn't use anything like & or nohup to move process to the background. Due to the limited time, it is left as it is. And log streaming was also commented out because it was conflicting with the container prompt

cgexec -g 'cpu,memory,pids:ship-'${CONTAINER_ID} \
    unshare --pid --mount --net --ipc --time --cgroup --uts --fork \
    chroot ${CONTAINER_ROOT}/ /bin/sh -c "mount -t proc proc /proc && $CMD" #2>&1 | tee ${SHIP_LOGS}/${CONTAINER_ID}/${CONTAINER_ID}.log || true

This issue can be used to suggest/improve/discuss the existing setup.

Acceptance Criteria

• Move container process in the background for non interactive mode.
• Possibly need to introduce some sort of flag to specify daemon mode.
• Moving container to background also need to pipe the container logs to /var/log/ship/${CONTAINER_ID}/${CONTAINER_ID}.log path.