Run Java in a chrooted jail

Question

I'm on a CentOS 6.5 machine with Plesk Panel which I used to create a chrooted environment for a user who can access it via ssh. I managed to let him use some basic non chroot standard command like chmod or ps. NOW what I need to do to let him use java to run his own compiled jar inside his new shiny jail?

Answer 1

Do not use chroot(). Use OpenVZ. OpenVZ is chroot on steroids: Not only does OpenVZ give a container its own root directory, it also gives a container its own init() process, its own process list, its own IP, its own memory and disk space quota, etc.

• http://openvz.org/Quick_installation
• Once OpenVZ is installed, go to /vz/template/cache and download a CentOS template: wget http://ftp.openvz.org/template/precreated/centos-6-x86-devel.tar.gz
• Now: vzctl create 100 --ostemplate centos-6-x86-devel
• Then: vzctl set 100 --ipadd 192.168.1.99 --save Change 192.168.1.99 to a static IP that will work on your network
• vzctl set 100 --nameserver 8.8.8.8 --save Use one of Google's free DNS servers
• vzctl start 100
• vzctl enter 100
• At the root prompt in the new container: yum -y update
• Install Java in the new container: yum install java-1.6.0-openjdk-devel.i686
• Make a user and password/SSH key for the container so your buddy can play with Java: adduser buddy followed by passwd buddy (replace "buddy" with any name you wish to use here)
• Make sure the container is running sshd so he can SSH in to the container.
• Make sure there is a way for him to get in to your computer.

The big gotcha here is that you will need to have full access to the machine in question and the computer will need to be on a network where you can assign a different IP for each container. Another gotcha is that the container will use about a gig of hard disk space -- more if your buddy makes a lot of files in the container. If the machine in question is a machine in a hosting environment, make sure the AUP you have allows you to run OpenVZ and other virtualization technologies (some hosting providers do not permit this).