gvisor-tap-vsock is almost perfect but some functionality is lacking for a sandbox usecase:
- expose a TUN interface (instead of TAP) for the sole purpose of giving a sandbox internet access and no other net access. (another project that also uses gvisor's netstack and accomplished this: github.com/xjasonlyu/tun2socks )
- remove IP assignment requirement (static & dhcp)
- restrict access level of the socket (make only /connect available)
example workflow:
on the host: gvproxy -listen unix:///path/gvproxy/test
inside a sandbox with /path/gvproxy/test shared: gvforwarder -url unix:///path/gvproxy/test -iface tap0 -preexisting
currently, every sandbox needs to have its IPs managed (when dhcp isn't an option) and can get too much info by talking to the socket.
currently if two sandboxes connect to gvproxy/test socket with their tap0's having the same IP routing of one will fail.
would be ideal if it were something like
gvforwarder -url unix:///path/gvproxy/test -iface tun0 -preexisting
where tun0 is just a result of some generic mktun script and
ip addr add [anything] dev tun0
route add default via [anything] dev tun0
another helpful option would be if gvforwarder could be made to accept an FD for tun/tap. some sandboxes have the ability to create a tun/tap interface rootlessly then further drop capabilities but pass the created FD onward.
gvisor-tap-vsock is almost perfect but some functionality is lacking for a sandbox usecase:
example workflow:
on the host:
gvproxy -listen unix:///path/gvproxy/testinside a sandbox with
/path/gvproxy/testshared:gvforwarder -url unix:///path/gvproxy/test -iface tap0 -preexistingcurrently, every sandbox needs to have its IPs managed (when dhcp isn't an option) and can get too much info by talking to the socket.
currently if two sandboxes connect to gvproxy/test socket with their tap0's having the same IP routing of one will fail.
would be ideal if it were something like
gvforwarder -url unix:///path/gvproxy/test -iface tun0 -preexistingwhere tun0 is just a result of some generic mktun script and
another helpful option would be if
gvforwardercould be made to accept an FD for tun/tap. some sandboxes have the ability to create a tun/tap interface rootlessly then further drop capabilities but pass the created FD onward.