nsjail

package
v0.10.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 7, 2026 License: MIT Imports: 11 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func SetupChildNetworking 

func SetupChildNetworking(vethNetJail string) error

SetupChildNetworking configures networking within the target process's network namespace. This runs inside the child process after it has been created and moved to its own network namespace.

func StartDummyDNSAndRedirect 

func StartDummyDNSAndRedirect(logger *slog.Logger) error

StartDummyDNSAndRedirect starts a dummy DNS server in-process (goroutine) listening on 127.0.0.1:5353 and redirects all DNS traffic (UDP/TCP port 53) in the namespace to it via iptables. This prevents DNS exfiltration: all DNS queries get a dummy response (6.6.6.6). Must be called from inside the network namespace.

Types

type Config 

type Config struct {
	Logger          *slog.Logger
	HttpProxyPort   int
	HomeDir         string
	ConfigDir       string
	CACertPath      string
	NoUserNamespace bool
}

type Jailer 

type Jailer interface {
	ConfigureHost() error
	Command(command []string) *exec.Cmd
	ConfigureHostNsCommunication(processPID int) error
	Close() error
}

type LinuxJail 

type LinuxJail struct {
	// contains filtered or unexported fields
}

LinuxJail implements Jailer using Linux network namespaces

func NewLinuxJail 

func NewLinuxJail(config Config) (*LinuxJail, error)

func (*LinuxJail) Close 

func (l *LinuxJail) Close() error

Close removes the network namespace and iptables rules

func (*LinuxJail) Command 

func (l *LinuxJail) Command(command []string) *exec.Cmd

Command returns an exec.Cmd configured to run within the network namespace.

func (*LinuxJail) ConfigureHost 

func (l *LinuxJail) ConfigureHost() error

ConfigureBeforeCommandExecution prepares the jail environment before the target process is launched. It sets environment variables, creates the veth pair, and installs iptables rules on the host. At this stage, the target PID and its netns are not yet known.

func (*LinuxJail) ConfigureHostNsCommunication 

func (l *LinuxJail) ConfigureHostNsCommunication(pidInt int) error

ConfigureHostNsCommunication finalizes host-side networking after the target process has started. It moves the jail-side veth into the target process's network namespace using the provided PID. This requires the process to be running so its PID (and thus its netns) are available.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.