You can rip a rootfs from a docker image using skopeo[1] and undocker[2] then you can puppeteer it with bwrap[3].
This works for most linux distributions (they behave well as fakeroot puppets).
Package managers from Debian-based distros tend to misbehave in bwrap in my experience.
I use this method to obtain software from various distro repositories or when RPM packages are distributed by vendors.
> Creating a chroot in Linux is pretty easy: put a rootfs in a folder and run the sudo chroot /my/folder command. But what if you don't want to use superuser privileges for this?
My very first thought is actually proot ( https://proot-me.github.io/ ), though that does have a performance hit.
That said, once you're using unshare (which is a good idea), why not just use podman? Mostly the same under the hood, but does a bunch of this for you. And for this exact usecase I appreciate that there are tradeoffs but I personally would have built pmbootstrap out of Dockerfiles in the first place.
Using wrappers doesn't really help that much because the difficulties are in the things that aren't covered anyway. Proot doesn't help for these issues, there's a long-standing open issue for that one.
Using docker would make the mixing and nesting of native and foreign architecture chroots only more difficult
Depending on what "user-mode Linux containers" means:
User Mode Linux (UML) - You could do that but at that point IMHO you might as well just run in qemu; UML is annoying to work with and performance isn't great.
Containers (of the sort popularized by docker and kubernetes) without root: As sibling comment says, this is that; from the kernel's view, manually calling unshare yourself looks the same as what podman or rootless docker do.
You can rip a rootfs from a docker image using skopeo[1] and undocker[2] then you can puppeteer it with bwrap[3].
This works for most linux distributions (they behave well as fakeroot puppets). Package managers from Debian-based distros tend to misbehave in bwrap in my experience.
I use this method to obtain software from various distro repositories or when RPM packages are distributed by vendors.
[1] <https://github.com/containers/skopeo>
[2] <https://git.jakstys.lt/motiejus/undocker>
[3] <https://github.com/containers/bubblewrap>
> Creating a chroot in Linux is pretty easy: put a rootfs in a folder and run the sudo chroot /my/folder command. But what if you don't want to use superuser privileges for this?
My very first thought is actually proot ( https://proot-me.github.io/ ), though that does have a performance hit.
That said, once you're using unshare (which is a good idea), why not just use podman? Mostly the same under the hood, but does a bunch of this for you. And for this exact usecase I appreciate that there are tradeoffs but I personally would have built pmbootstrap out of Dockerfiles in the first place.
Using wrappers doesn't really help that much because the difficulties are in the things that aren't covered anyway. Proot doesn't help for these issues, there's a long-standing open issue for that one.
Using docker would make the mixing and nesting of native and foreign architecture chroots only more difficult
What about user-mode Linux containers?
Depending on what "user-mode Linux containers" means:
User Mode Linux (UML) - You could do that but at that point IMHO you might as well just run in qemu; UML is annoying to work with and performance isn't great.
Containers (of the sort popularized by docker and kubernetes) without root: As sibling comment says, this is that; from the kernel's view, manually calling unshare yourself looks the same as what podman or rootless docker do.
These are user-mode containers