Could you please consider optionally using systemd-nspawn inside mmdebstrap?
Seems like a much cleaner way for me to do stuff inside chroots. Better host / chroot isolation. Less risk of accidental host modifications.
Maybe as a mode?
MODES as per:
unshare mode Quote "A directory chroot created with this mode will end up with wrong permissions."
I was hoping that systemd-nspawn would not have this issue. My idea was "no need 'real' sudo/root required, cleaner separation, less risk of accidental host modifications, and no file permission issues".
If you want to create a directory with files owned by root, then you need superuser privileges. If you want to combine "clean separation less risk of accidental host modifications" with "no file permission issues" then you can simply use the unshare mode to create tarball without superuser privileges. And then unpack the tarball with superuser privileges.
As the part you quote says, the limitation only applies to directory chroots. Creating a tarball containing files with superuser privileges is no problem.
I'm not trying to shoot down this idea and I would accept a patch implementing this but it's not high on my priority list because I don't see the benefits right now.
I would like to combine mmdebstrap with cowbuilder (pbuilder) (build packages in clean chroot) and grml-debootstrap (Debian bootable raw image creation tool) but without risk of host modifications. But I guess then it would be up to these tools to use linux namespaces or systemd-nspawn?
Then you could use debootstrap. Its codebase is well tested, so even though it's using plain chroot, the risk of host modifications should be low.
--debootstrapoption to pass an alternative to debootstrap like mmdebstrap. If unprivileged user namespaces are enabled on your system, then mmdebstrap will use linux user namespaces automatically which will give you the isolation you want. You can also use the
--debootstrapoptsoption to pass custom options to mmdebstrap as run by pbuilder and cowbuilder like
And yes, pbuilder and cowbuilder are obviously also free to run
debootstrapwith linux user namespaces. There even exist patches to debootstrap to enable this: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=829134
It seems that systemd-nspawn doesn't work for mmdebstrap because I cannot pass file descriptors around:
dpkg: error: unable to read filedescriptor flags for <package status and progress file descriptor>: Bad file descriptor
This is even with
--console=pipe. I will not spend more time on this. Maybe somebody else will.