I will be using Ubuntu Linux for this project.For training of a particular application at a conference I need:To have each student be able to ssh into the same user account on a serverUpon each login automatically put the user in separate isolated environmentsEach isolated environment includes the application, example config files, and the standard unix toolset (e.g. grep, awk, sort, uniq, etc.) However, access to an entire linux filesystem is fine too as long as the user can only damage his own isolated environment and not those of others.The virtual environments should be destroyed when the users SSH session endsFor #1 we would like to do the single user account so we don't have to deal with creating an account for each student and handing out the user names and passwords.Does anyone know how I can meet these goals? Which technology e.g. LXC, Chroot, etc. is best for this? I've been toying with the idea of using .bash_profile and .bash_logout to handle the creation and destruction of these environments but not sure which technology is capable of creating the environments I need.
replicate and isolating user environments on the fly
linux;chroot;lxc;container
With Docker you can do this very easily.docker pull ubuntudocker run -t -i ubuntu /bin/bash# make your changes and then log outdocker commit $(docker ps -a -q | head -n 1) sandboxcat > /usr/local/bin/sandbox <<EOF#!/bin/shexec docker run -t -i --rm=true sandbox /bin/bashEOFchmod a+x /usr/local/bin/sandboxecho /usr/local/bin/sandbox >> /etc/shellsuseradd testuser -g docker -s /usr/local/bin/sandboxpasswd testuserWhenever testuser logs in, they will be placed into an isolated container where they can't see anything outside it, not even the containers of other users.The container will then be automatically removed when they log out.Explanation:docker pull ubuntuHere we fetch the base image that we're going to work with. Docker provides standard images, and ubuntu is one of them. docker run -t -i ubuntu /bin/bash# make your changes and then log outHere we launch a shell from the ubuntu image. Any changes you make will be preserved for your users.You could also use a Dockerfile to build the image, but for a one time thing, I think this is simpler. docker commit $(docker ps -a -q |  head -n 1) sandboxHere we convert the last container that was run into a new image called sandbox. cat > /usr/local/bin/sandbox <<EOF#!/bin/shexec docker run -t -i --rm=true sandbox /bin/bashEOFThis will be a fake shell that the user is forced to run on login. The script will launch them into a docker container which will automatically be cleaned up as soon as they log out. chmod a+x /usr/local/bin/sandboxI hope this is obvious :-) echo /usr/local/bin/sandbox >> /etc/shellsThis may not be required on your system, but on mine a shell cannot be a login shell unless it exists in /etc/shells. useradd testuser -g docker -s /usr/local/bin/sandboxWe create a new user that with their shell set to a script we will create. The script will force them to launch into the sandbox container. They are a member of the docker group so that the user can launch a new container.An alternative to putting the user in the docker group would be to grant them sudo permissions to a single command. passwd testuserI hope this is also obvious. 