ایجاد یک ظرف حداقل در GO: یک راهنمای گام به گام (قسمت 1)

Go programming language: Install Go
Basic understanding of Linux namespaces and control groups

A user namespace has its own set of user IDs and group IDs for assignment to processes. In particular, this means that a process can have root privilege within its user namespace without having it in other user namespaces.
A process ID (PID) namespace assigns a set of PIDs to processes that are independent from the set of PIDs in other namespaces. The first process created in a new namespace has PID 1 and child processes are assigned subsequent PIDs. If a child process is created with its own PID namespace, it has PID 1 in that namespace as well as its PID in the parent process’ namespace. See below for an example.
A network namespace has an independent network stack: its own private routing table, set of IP addresses, socket listing, connection tracking table, firewall, and other network‑related resources.
A mount namespace has an independent list of mount points seen by the processes in the namespace. This means that you can mount and unmount filesystems in a mount namespace without affecting the host filesystem.
An interprocess communication (IPC) namespace has its own IPC resources, for example POSIX message queues.
A UNIX Time‑Sharing (UTS) namespace allows a single system to appear to have different host and domain names to different processes.

the container are fast isolated environment , we will focus on this part many things are involved and my main goal is to Demystifying Containers

assuming that you are on a linux machine (try Power shell Ubuntu image if you are on Windows :-)

host-machine $ id

uid=1000(mohamed) gid=1000(mohamed) groups=1000(mohamed) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c.1023

root # ps -ef
UID         PID     PPID  C STIME TTY        TIME CMD
root          1        0  0 14:46 pts/0  00:00:00 bash
root         15        1  0 14:46 pts/0  00:00:00 ps -ef
root # id
uid=0(root) gid=0(root) groups=0(root) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c.1023

Resource limits — You can configure a cgroup to limit how much of a particular resource (memory or CPU, for example) a process can use.
Prioritization — You can control how much of a resource (CPU, disk, or network) a process can use compared to processes in another cgroup when there is resource contention.
Accounting — Resource limits are monitored and reported at the cgroup level.
Control — You can change the status (frozen, stopped, or restarted) of all processes in a cgroup with a single command.

root # mkdir -p /sys/fs/cgroup/memory/foo
root # echo 50000000 > /sys/fs/cgroup/memory/foo/memory.limit_in_bytes

root # ./test.sh &
[1] 2428
root # cgroup testing tool
root # echo 2428 > /sys/fs/cgroup/memory/foo/cgroup.procs

root # ps -o cgroup 2428
CGROUP
12:pids:/user.slice/user-0.slice/\
session-13.scope,10:devices:/user.slice,6:memory:/foo,...

Setting a New Root Directory: When you execute the chroot system call or the chroot command in the shell, it changes the root directory for the process and its children. The new root directory becomes the / (root) directory for that process, isolating it from the actual root directory of the host system.
Isolation: After the chroot operation, the process and its children can only access files and directories within the new root directory. They cannot access files outside this new root, providing a level of isolation and containment.

System Recovery: chroot is commonly used in system recovery scenarios. If your system becomes unbootable or experiences issues, you can boot from a live CD/USB, chroot into the broken system, and make necessary repairs without affecting the rest of the host system.
Environment Isolation: Developers and system administrators may use chroot to create isolated environments for testing or building software. This is especially common in scenarios where different versions of libraries or dependencies are required.
Security: Although chroot provides some level of isolation, it's not foolproof in terms of security. It was not designed as a security feature and should not be solely relied upon for containing malicious processes. Modern containerization technologies, like Docker, utilize more advanced mechanisms, such as Linux namespaces and cgroups, to provide stronger isolation.

mkdir mychroot
cp -r /bin /lib /lib64 /usr /mychroot
chroot /mychroot /bin/bash

We create a directory called mychroot and copy essential binaries and libraries into it.
We use chroot to change the root directory to /mychroot.
After the chroot command, executing /bin/bash will run a Bash shell within the isolated environment.

$ docker run -d --rm --name ubuntu_fs ubuntu:20.04 sleep 1000
$ mkdir -p ./ubuntu_fs
$ docker cp ubuntu_fs:/ ./ubuntu_fs
$ docker stop ubuntu_fs

package main

import (
 "io/ioutil"
 "log"
 "os"
 "os/exec"
 "path/filepath"
 "strconv"
 "syscall"
 "strings"
 "fmt"
 "github.com/vishvananda/netns"

)



func main() {
 switch os.Args[1] {
 case "run":
  run(os.Args[2:]...)
 case "child":
  child(os.Args[2:]...)
 default:
  log.Fatal("Unknown command. Use run , like `run /bin/bash` or `run echo hello`")
 }
}



func run(command ...string) {

 log.Println("Executing", command, "from run")
 cmd := exec.Command("/proc/self/exe", append([]string{"child"}, command[0:]...)...)
 cmd.Stdin = os.Stdin
 cmd.Stdout = os.Stdout
 cmd.Stderr = os.Stderr

 // Cloneflags is only available in Linux
 // CLONE_NEWUTS namespace isolates hostname
 // CLONE_NEWPID namespace isolates processes
 // CLONE_NEWNS namespace isolates mounts
 cmd.SysProcAttr = &syscall.SysProcAttr{
  Cloneflags: syscall.CLONE_NEWUTS | syscall.CLONE_NEWPID | syscall.CLONE_NEWNS ,
  Unshareflags: syscall.CLONE_NEWNS | syscall.CLONE_NEWNET, 
 }

 // Run child using namespaces. The command provided will be executed inside that.
  must(cmd.Run())
}




func child(command ...string) {

 // Create cgroup
 cg()





 cmd := exec.Command(command[0], command[1:]...)

 cmd.Stdin = os.Stdin
 cmd.Stdout = os.Stdout
 cmd.Stderr = os.Stderr


 must(syscall.Sethostname([]byte("container")))


 must(syscall.Chroot("./ubuntu_fs"))
 // Change directory after chroot
 must(os.Chdir("https://dev.to/"))
 // Mount /proc inside container so that `ps` command works
 must(syscall.Mount("proc", "proc", "proc", 0, ""))
 // Mount a temporary filesystem
 if _, err := os.Stat("mytemp"); os.IsNotExist(err) {
  must(os.Mkdir("mytemp", os.ModePerm))
 }
 must(syscall.Mount("something", "mytemp", "tmpfs", 0, ""))




 must(cmd.Run())

 // Cleanup mount
 must(syscall.Unmount("proc", 0))
 must(syscall.Unmount("mytemp", 0))
}




func cg() {
 // cgroup location in Ubuntu
 cgroups := "/sys/fs/cgroup/"

 pids := filepath.Join(cgroups, "pids")
 containers_mini := filepath.Join(pids, "containers_mini")
 os.Mkdir(containers_mini, 0755)
 // Limit to max 20 pids
 must(ioutil.WriteFile(filepath.Join(containers_mini, "pids.max"), []byte("20"), 0700))
 // Cleanup cgroup when it is not being used
 must(ioutil.WriteFile(filepath.Join(containers_mini, "notify_on_release"), []byte("1"), 0700))

 pid := strconv.Itoa(os.Getpid())
 // Apply this and any child process in this cgroup
 must(ioutil.WriteFile(filepath.Join(containers_mini, "cgroup.procs"), []byte(pid), 0700))
}

func must(err error) {
 if err != nil {
  log.Printf("Error: %v\n", err)
   panic(err)
 }
}

func main() {
    switch os.Args[1] {
    case "run":
        run(os.Args[2:]...)
    case "child":
        child(os.Args[2:]...)
    default:
        log.Fatal("Unknown command. Use run , like `run /bin/bash` or `run echo hello`")
    }
}

this command cmd := exec.Command(“/proc/self/exe”, append([]string{“child”}, command[0:]…)…)
make sure that it’s append all command to same process
The Cloneflags specify the namespaces to be isolated (UTS, PID, and mount namespaces).
The Unshareflags further isolate the network namespace.
The cmd.Run() method runs the provided command within the created container.

func child(command ...string) {
    // ...
    cg()
    must(syscall.Sethostname([]byte("container")))
    must(syscall.Chroot("./ubuntu_fs"))
    must(os.Chdir("https://dev.to/"))
    must(syscall.Mount("proc", "proc", "proc", 0, ""))
    must(syscall.Mount("something", "mytemp", "tmpfs", 0, ""))
    must(cmd.Run())
    must(syscall.Unmount("proc", 0))
    must(syscall.Unmount("mytemp", 0))
}

The cg function sets up a control group (cgroup) to limit resource usage for the container.
Sethostname sets the hostname inside the container.
Chroot changes the root directory for the container.
Mount is used to mount essential filesystems like /proc and a temporary filesystem.
Finally, the command is executed within the container.

func cg() {
 // cgroup location in Ubuntu
 cgroups := "/sys/fs/cgroup/"

 pids := filepath.Join(cgroups, "pids")
 containers_mini := filepath.Join(pids, "containers_mini")
 os.Mkdir(containers_mini, 0755)
 // Limit to max 20 pids
 must(ioutil.WriteFile(filepath.Join(containers_mini, "pids.max"), []byte("20"), 0700))
 // Cleanup cgroup when it is not being used
 must(ioutil.WriteFile(filepath.Join(containers_mini, "notify_on_release"), []byte("1"), 0700))

 pid := strconv.Itoa(os.Getpid())
 // Apply this and any child process in this cgroup
 must(ioutil.WriteFile(filepath.Join(containers_mini, "cgroup.procs"), []byte(pid), 0700))
}

Cgroups are used to control and limit resource usage for processes.
In this example, the cgroup limits the maximum number of processes to 20.

func must(err error) {
    if err != nil {
        log.Printf("Error: %v\n", err)
        panic(err)
    }
}

Build the executable: go build -o mycontainer main.go
Create a filesystem directory with an Ubuntu root filesystem, e.g., ubuntu_fs.
Run the container: sudo ./mycontainer run /bin/bash
remember you need to run it as sudo
your entry point is /bin/bash

read this will help you more

namespace & golang a series of article explains namespace with go examples

“Creating Network Stacks and Connecting with the Internet” by “Shrikanta Mazumder”