Add NSenter tunnel that allows to enter in any linux namespace container

[amigrave]

NSEnter: A tunnel to a process on the same host, launched with nsenter.

This is a generic tunnel for all containers using linux namespaces such as docker, systemd-nspawn, rkt, ... that can be spawned as a subprocess of any given process id. This tunnel uses sudo hence it
requires the same passworless setup than the Sudo tunnel plus the nsenter command line utility found in linux-utils package.

[amigrave]

Hi @lordmauve , here's a pull request about an nsenter tunnel we discussed about at the Europython.

I also have a couple of questions about chopsticks, can you tell where's the best place to ask them ?

Thanks.

[lordmauve]

Thanks, this is interesting. I'd like to review some documentation for nsenter before I merge this, if you can wait a few days.

There is a Gitter for general questions about Chopsticks.

[amigrave]

Thanks, this is interesting. I'd like to review some documentation for nsenter before I merge this, if you can wait a few days.

of course !

There is a Gitter for general questions about Chopsticks.

ok, see you there, then. I sent you a mail some time ago but it must have landed in /dev/null or spam :)

[amigrave]

Thanks, this is interesting. I'd like to review some documentation for nsenter before I merge this, if you can wait a few days.

I just realized that maybe I should have use ctypes in order to do the setns system calls from python instead of executing nsenter. That would need a bit of refactoring of SubprocessTunnel in order to make the subprocess.Popen's preexec_fn callable overloadable but it's not a big deal.

Would you mind keeping this PR "on hold" until I have time to make some tests ?

[lordmauve]

I don't think we should maintain ctypes bindings for nsenter within Chopsticks. If you create a library we could make Chopsticks use it if it is installed.

[amigrave]

You're right! There's already python-nsenter.

But now that I'm thinking about it, I realize that there's an impact for the enduser.
The NSEnter tunnel I currently proposed in this PR is working like the Sudo tunnel, so the user is supposed to setup it's passwordless sudo config in order to allow the NSEnter tunnel to use sudo when launching the nsenter command.

If we're making the system calls ourselves via python-nsenter, it means that the script using chopsticks should be launched with the root permission which might not be what a user wants and is probably not the usage of chopsticks you foreseen.

So before going further I'd like to have your opinion on that topic.