First of all, I know about virtualisation and containers. I'm sure he wants containers is what popped in your mind. (Don't deny it!)However containers are like chroot: if you want to execute bash in it, you need to copy/mirror a bash executable somewhere in the container FS as well as all the required libs. (If I misunderstood something, please correct me).What I want to know is whether I can start a program like busybox from the current namespace (using the original FS, so no copy needed) and then isolate it (for instance using Linux FS namespace) to let it access one unique directory.Somehow ssh (sftp actually) seems to be able to do something like this without requiring the sshd executable to be in the chrooted FS. But I still lack skills to understand what's going on by myself.
Is there a way to isolate a running program from the rest of a Linux system?
chroot;jails;namespace
I think you're probably looking for containers.Or perhaps not. Linux namespaces can be pretty transparent, after all. I don't believe there is a way to unshare a namespace for a process which has already been called, but you definitely can unshare a namespace at call time with little to no effect.cd   /tmpecho you >heysudo unshare -m busyboxecho hey >you; cat  heyyou...and from another terminal...cd   /tmpcat  youhey...the mount tree is shared by default from the parent namespace, and, though busybox's mount propagation flags are all set to private by default, it makes no difference until a change to the mount tree is somehow effected in the namespace. This need not be done through busybox, either....in busybox's terminal...echo #$$#8854...and now from the other...sudo nsenter -t8854 -m mount -t tmpfs none /tmpcd .; cat heyyou...but from busybox's terminal, and therefore from the namespace we just effected a mount...cd .;  cat heycat: hey: no such file or directory...because a new private tmpfs was mounted over the shared /tmp in the nsenter command...cd ..umount tmpcat tmp/heyyou