Squashfused is a tool that allows unprivileged rootless Podman containers to mount SquashFS images at runtime through squashfuse. No additional command-line option is required after installation.
"Squashfused" almost sounds like a new Linux kernel vulnerability, but calm down. It's a tool, not a vulnerability (nor using one, either). It was supposed to be short for "Squashfuse-delegate." You can pronounce it however you prefer: "Squashfused" or "Squashfuse-Dee."
By default, users cannot perform mount operations inside rootless containers because they require a SYS_ADMIN capability. This capability can be granted via --cap-add SYS_ADMIN (or, even more radically, --privileged) in the container launch command, but doing so enables container breakout and/or the host system compromise, defeating the purpose of rootless containers.
However, at times, users inside rootless containers need to perform mount operations on the fly. A prime example is SquashFS images, which are commonly used for data archives. If they forgot to mount some SquashFS archives at container launch (which, in principle, they already can even if the container is rootless), they may want to mount additional archives at container runtime. But granting privilege to allow this at the cost of rootlessness seems too excessive.
Squashfused was developed to just enable the SquashFS mount (in a limited sense) without granting privilege. Basically, Squashfused spawns a host-side "delegate daemon" that forwards a SquashFS mount request from the "stub squashfuse" inside rootless containers. The mount result is seen inside the containers via mount propagation, which gives users the "illusion" that they mounted the requested SquashFS image inside rootless containers.
- Your host system should have:
squashfuseandjq. - You should launch containers via
podman; unfortunately, other OCI container engines, like Docker, are not supported. - Your host system should be
systemd-based. - Your host system and container image should have
bash. (requirement droppable in the future)
- Clone this repository and run
make installasroot.
$ sudo make install
- Reboot the system to start the Squashfused server (systemd unit), or manually start it by:
$ systemctl --user daemon-reload
$ systemctl --user restart squashfused-server.service
Once installed, Squashfused is available to all accounts, including the LDAP-linked ones.
Same as the squashfuse usage described here. For example, inside the container,
$ ls
test.sqfs mount_dir
$ ls mount_dir
(empty)
$ # Mount 'test.sqfs' to 'mount_dir'.
$ squashfs test.sqfs mount_dir
$ ls mount_dir
file_in_sqfs
$ # Unmount 'mount_dir'.
$ umount mount_dir # or 'fusermount -u mount_dir'.
$ ls mount_dir
(empty)
Note: The container launch doesn't require any special option.
A demo is also available; in the demo directory, run make do_demo after installation.
If you didn't like Squashfused, you could uninstall it entirely with this command. No system dependency is touched.
$ sudo make clean
A less-technical introductory blog post can be found here.