Feature Request: ability to run GroundSeg inside docker

[neonfuz]

There are other projects out there that manage docker containers with another docker container, so this should be possible.

IMO it's higher priority than #589 because users that care about the root user issue can partly mitigate it by running GroundSeg inside docker. Not perfect, but better than running as root on the host.

[yapishu]

I think a hard blocker for this is managing wifi devices, we punt to nmcli on the host because writing our own interface management stuff is a huge burden and likely to be signficantly worse; same with managing power and OS updates though there might be some cute tricks for that

[neonfuz]

Rancher OS managed to do it, doesn't look easy though:

https://hub.docker.com/r/rancher/network-manager
https://www.rancher.com/docs/os/v1.x/en/networking/interfaces/

If you don't know about Rancher:

RancherOS is the smallest, easiest way to run Docker in production. Every process in RancherOS is a container managed by Docker. This includes system services such as udev and syslog. Because it only includes the services necessary to run Docker, RancherOS is significantly smaller than most traditional operating systems. By removing unnecessary libraries and services, requirements for security patches and other maintenance are also reduced. This is possible because, with Docker, users typically package all necessary libraries into their containers.

Everything in RancherOS is a Docker container. We accomplish this by launching two instances of Docker. One is what we call System Docker and is the first process on the system. All other system services, like ntpd, syslog, and console, are running in Docker containers. System Docker replaces traditional init systems like systemd and is used to launch additional system services.

System Docker runs a special container called Docker, which is another Docker daemon responsible for managing all of the user’s containers. Any containers that you launch as a user from the console will run inside this Docker. This creates isolation from the System Docker containers and ensures that normal user commands don’t impact system services.

We created this separation not only for the security benefits, but also to make sure that commands like docker rm -f $(docker ps -qa) don’t delete the entire OS.

I would recommend Rancher as a base for a groundseg OS, but after 1.x they migrated from docker to kubernetes. Perhaps groundseg could run well on kubernetes, but I'm not very familiar with it so I can't say how that transition would go. Still, you could potentially copy some of the design from them to get things like system services inside docker.