You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Being able to browse / in a docker container might be unwanted behavior.
I'd like to set an environment variable which locks the file/folder browser to a certain directory, such as /data/projects, etc.
What about using systemd to lock down the session? Systemd is very powerful at that, it's even possible to set some parameters to protect against a fork bomb:
You can build a custom docker image based on the existing image. See docker's FROM. So you wouldn't have to do things each time.
We can evaluate docker containers as terminals in a different issue.
This issue was about locking vscode server down which I think is out of scope. You can put it in a VM or a container easily if you want an isolated environment.
Activity
kylecarbs commentedon Mar 7, 2019
Interesting. Wouldn't someone be able to use the terminal to break out anyways?
For a jailed session, I'd recommend running a docker container with the project directory mounted in.
unixfox commentedon Mar 8, 2019
What about using systemd to lock down the session? Systemd is very powerful at that, it's even possible to set some parameters to protect against a fork bomb:
systemd nspawn would be also a great tool to easily lock down the session: https://wiki.archlinux.org/index.php/systemd-nspawn
On systemd nspawn you can even launch unprivileged containers.
unixfox commentedon Mar 8, 2019
I didn't mean to only use systemd, we could provide several type of config for the user.
nhooyr commentedon Mar 8, 2019
I don't think its appropriate to implement this as part of code-server.
You can always deploy the docker image and only mount the directory you want edited.
nhooyr commentedon Mar 9, 2019
You can build a custom docker image based on the existing image. See docker's
FROM. So you wouldn't have to do things each time.We can evaluate docker containers as terminals in a different issue.
This issue was about locking vscode server down which I think is out of scope. You can put it in a VM or a container easily if you want an isolated environment.