mirror of
https://github.com/netbirdio/netbird.git
synced 2026-10-13 00:49:07 +02:00
Maycon Santos
66a28fd666
Reaching an internal service meant installing the agent, which needs root for a TUN device. nblink runs the embedded client in netstack mode and forwards local HTTP listeners to upstreams inside the tunnel, so it works on managed machines and in rootless containers. Upstream names resolve in-process. Forwards bind loopback unless --allow-public-bind is given. The listener refuses rebound and cross-site browser requests and bounds stalled request bodies. It ships as release archives and a distroless image that runs under an arbitrary UID. An embedded client given no StatePath now keeps its state in memory rather than falling back to the installed agent's state file, which every embedded client in a proxy process also shared. The state manager gets an explicit in-memory store for it.
35 lines
1.5 KiB
Plaintext
35 lines
1.5 KiB
Plaintext
# nblink runs unprivileged: no TUN device, no capabilities, no host networking.
|
|
#
|
|
# The image is built for platforms that assign an arbitrary UID at run time, so
|
|
# it must not depend on a passwd entry and its state directory has to be
|
|
# writable by the root group rather than by one named user.
|
|
FROM alpine:3.22 AS build
|
|
|
|
# Group 0 owns the state directory so a container started as any UID in that
|
|
# group can still persist its identity. Mode 770 rather than g=u, because the
|
|
# directory holds the peer's keys and nothing outside owner and group should
|
|
# read them, including when the path is bind-mounted from a host.
|
|
RUN mkdir -p /tmp/state/nblink \
|
|
&& chgrp -R 0 /tmp/state/nblink \
|
|
&& chmod -R 770 /tmp/state/nblink
|
|
|
|
FROM gcr.io/distroless/static-debian13:nonroot
|
|
|
|
ARG TARGETPLATFORM
|
|
COPY ${TARGETPLATFORM}/nblink /usr/local/bin/nblink
|
|
# COPY of a directory copies its contents and creates the target with mode
|
|
# 755, which group 0 cannot write. Copying the parent makes nblink/ itself the
|
|
# copied entry, so its mode survives.
|
|
COPY --from=build --chown=65532:0 /tmp/state/ /var/lib/
|
|
|
|
# Numeric so the runtime can substitute its own UID without a passwd lookup.
|
|
USER 65532:0
|
|
|
|
# No NB_STATE_DIR by default: state stays in memory, so the image runs on a
|
|
# read-only root filesystem without a volume. Set NB_STATE_DIR=/var/lib/nblink
|
|
# and mount a volume there to keep the peer identity; a volume mounted over
|
|
# the directory starts out with its group-0 ownership.
|
|
ENV NB_LOG_LEVEL=info
|
|
|
|
ENTRYPOINT ["/usr/local/bin/nblink"]
|