feat: nested-Docker sandbox — --no-bwrap, greywall-netns-helper, --netns, --bridge-port

[tito]

Draft. Three stacked commits that together make greywall usable in environments where bubblewrap cannot create user namespaces — most notably inside Docker (including Docker Desktop) running as a non-root user, where uid_map writes are blocked by the host kernel regardless of cap_add SYS_ADMIN + seccomp=unconfined + apparmor=unconfined. See containers/bubblewrap#505 for the underlying limitation.

Each commit stands on its own feature; they are filed together because the later ones depend on the first. Happy to split if that makes review easier.

Commits

1. feat: --no-bwrap mode for nested-Docker / rootless environments (7c10e28)

Adds a --no-bwrap flag that skips bubblewrap entirely and enforces the sandbox using primitives that work for an unprivileged process:

• Landlock — reused from the existing --landlock-apply wrapper.
• seccomp-bpf — new direct loader via prctl(PR_SET_NO_NEW_PRIVS) + seccomp(SECCOMP_SET_MODE_FILTER) in a new internal/sandbox/linux_seccomp_apply.go. The existing generateBPFInstructions() was factored out of writeBPFProgram so both the file-writing path (bwrap --seccomp 3) and the direct-load path can share it.
• env-var SOCKS5/HTTP proxy — WrapCommandLinuxNoBwrap (new file) emits the proxy URL via ALL_PROXY / HTTPS_PROXY instead of bwrap's tun2socks. Fine for well-behaved HTTP clients; raw-socket bypass is possible at this layer (commit feat: Homebrew tap formula with brew-aware commands #2 addresses that).

Files:

cmd/greywall/main.go                         +33
internal/sandbox/linux_nobwrap.go            +69 (new)
internal/sandbox/linux_seccomp.go            +30 / −18 (refactor)
internal/sandbox/linux_seccomp_apply.go      +86 (new)
internal/sandbox/linux_seccomp_apply_stub.go  +8 (new)
internal/sandbox/linux_stub.go                +5
internal/sandbox/manager.go                  +25

Behaviour when --no-bwrap is unset: unchanged.

2. feat: greywall-netns-helper + --netns flag for transparent capture (5de0788)

Adds a separate helper binary greywall-netns-helper (installed with setcap cap_net_admin,cap_sys_admin+ep, never root) that:

• create --proxy URL — unshare(CLONE_NEWNET), bring up tun0 at 198.18.0.1/15, set default route via tun0, launch the existing embedded tun2socks inside the netns pointed at the SOCKS5 proxy, bind-mount /proc/self/ns/net to /run/greywall/ns-<uuid> to pin it, print the pin path, exit.
• exec --netns PATH -- CMD — setns into the pin, drop all caps (effective + permitted + inheritable + ambient + bounding set), syscall.Exec the user command. Rejects paths outside /run/greywall so the file caps can't be leveraged to enter arbitrary netns.
• destroy PATH — SIGTERM the recorded tun2socks pid, unmount and remove the pin.

The main greywall binary gets a paired --netns <path> flag that, when combined with --no-bwrap, prefixes the command chain with greywall-netns-helper exec --netns <path> -- so the wrapped process enters the prepared netns before Landlock/seccomp are applied.

Result: kernel-enforced egress capture (every TCP/UDP packet goes through tun0 → tun2socks → SOCKS5) without requiring the wrapped process to hold any capabilities and without relying on it honoring proxy env vars. Raw sockets are no longer a bypass.

Ambient-caps dance for CAP_NET_ADMIN is used so ip/tun2socks children of the helper inherit the capability without the helper having to reimplement the netlink calls in Go.

3. feat(netns-helper): --bridge-port (e735ca7)

Optional --bridge-port N flag on create that makes a TCP server inside the netns reachable from the host netns (typical use: a sandboxed server whose API is consumed by a trusted host-netns orchestrator). Mechanism:

• Inside netns: socat UNIX-LISTEN:<pin>.sock → TCP:127.0.0.1:N
• Host netns (sibling spawned before unshare): socat TCP4-LISTEN:N,bind=127.0.0.1 → UNIX-CONNECT:<pin>.sock
• The shared Unix socket lives on the regular filesystem, so it crosses the netns boundary transparently.

destroy now reads a multi-line PID sidecar (<pin>.pid carrying tun2socks + both socat pids) and SIGTERMs every recorded pid. The _bridge-host internal subcommand validates that the socket path sits alongside a valid pin so the file caps can't be abused to proxy arbitrary Unix sockets.

Security notes

• The main greywall binary stays uncap'd; all privileged setup is isolated to the tiny greywall-netns-helper binary.
• greywall-netns-helper exec validates its --netns path is under /run/greywall/ and drops every cap set (effective, permitted, inheritable, ambient, bounding) before syscall.Exec.
• greywall-netns-helper _bridge-host (internal) validates its --socket path similarly.
• File caps (cap_net_admin,cap_sys_admin+ep) are the principle of least privilege for the helper: CAP_SYS_ADMIN is required to unshare(CLONE_NEWNET) and setns; CAP_NET_ADMIN for ip tuntap/addr/link/route. Nothing else.

Install delta

• Linux: package dependencies gain iproute2 (the ip tool) and libcap2-bin (at install-time, for setcap). tun2socks binary is already embedded in the greywall source tree for amd64/arm64.
• A writable /run/greywall/ directory owned by the invoking user must exist at runtime (helper does not attempt to chown). Suggested deployment: mkdir -p /run/greywall && chown $USER:$USER /run/greywall, or a systemd-tmpfiles drop-in.

Testing

All three commits verified end-to-end inside a plain python:3.12-slim Docker container running as a non-root user with the usual cap_add SYS_ADMIN NET_ADMIN + security_opt seccomp=unconfined apparmor=unconfined:

• --no-bwrap alone: wrapped process has uid=1000, CapEff=0, NoNewPrivs=1, Seccomp=2, Seccomp_filters=1, Landlock rules enforced (write to /etc → EACCES), write to cwd allowed.
• --no-bwrap --netns <pin>: same sandbox state plus the process netns differs from the host netns; ip -br link inside shows only lo + tun0, eth0 not visible.
• --bridge-port 4096: a host-netns client connects to 127.0.0.1:4096 and talks to an HTTP server bound at 127.0.0.1:4096 inside the netns; round-trip confirmed with a standard health-check response.
• Cleanup on destroy: all three pids (tun2socks + 2 socat) are gone, pin + .sock + .pid files unlinked.

Builds clean on go build ./... and GOOS=linux GOARCH=arm64 go build ./....

Test plan

• go build ./... on darwin/arm64
• GOOS=linux GOARCH=arm64 go build ./...
• --no-bwrap -- <cmd> as non-root user in Docker → Landlock + seccomp applied
• greywall-netns-helper create → netns pinned, tun2socks up, helper exits cleanly
• greywall --no-bwrap --netns <pin> -- <cmd> → child runs in isolated netns with no caps
• greywall-netns-helper destroy → all pids SIGTERM'd, files cleaned up
• --bridge-port N → bidirectional TCP reachable from host netns
• Cross-review of the setcap'd helper's security posture by maintainers