envbox

Introduction

envbox is an image that enables creating non-privileged containers capable of running system-level software (e.g. dockerd, systemd, etc) in Kubernetes.

It mainly acts as a wrapper for the excellent sysbox runtime developed by Nestybox. For more details on the security of sysbox containers see sysbox's official documentation.

Envbox Configuration

The environment variables can be used to configure various aspects of the inner and outer container.

Coder Template

A Coder Template can be found in the coder/coder repo to provide a starting point for customizing an envbox container.

To learn more about Coder Templates refer to the docs.

Development

It is not possible to develop envbox effectively using a containerized environment (includes developing envbox using envbox). A VM, personal machine, or similar environment is required to run the integration test suite.

CODER_IMAGE_PULL_SECRET Kubernetes Example

If a login is required to pull images from a private repository, create a secret following the instructions from the Kubernetes Documentation as such:

kubectl -n <coder namespace> create secret docker-registry regcred \
        --docker-server=<your-registry-server> \
        --docker-username=<your-name> \
        --docker-password=<your-pword> \
        --docker-email=<your-email>

Then reference the secret in your template as such:

env {
  name = "CODER_IMAGE_PULL_SECRET"
  value_from {
    secret_key_ref {
      name = "regcred"
      key =  ".dockerconfigjson"
    }
  }
}

Note:

If you use external tooling to generate the secret, ensure that it is generated with the same fields as kubectl create secret docker-registry. You can check this with the following command:

console kubectl create secret docker-registry example --docker-server=registry.domain.tld --docker-username=username --docker-password=password --dry-run=client --output=json | jq -r '.data[".dockerconfigjson"]' | base64 -d | jq

Sample output:

json { "auths": { "registry.domain.tld": { "username": "username", "password": "password", "auth": "dXNlcm5hbWU6cGFzc3dvcmQ=" // base64(username:password) } } }

GPUs

When passing through GPUs to the inner container, you may end u