CONTAINER-SHELL(1)

💅 container-shell — the manual, but make it cute

bestie, welcome to container-shell(1) — the part of the General Commands Manual where we learn how to manage systemd-nspawn containers without ever touching a root shell. grab a strawberry 🍓 and let's go.

---

✨ NAME ✨

container-shell — manage systemd-nspawn containers (shell). that's the whole vibe. a shell for your containers. 🫶

---

🌸 SYNOPSIS 🌸

container-shell ['OPTIONS']
cntsh ['OPTIONS']

yep, there's a short nickname too. cntsh. iconic, no cap. 👑

---

🦋 DESCRIPTION 🦋

so compute-tools is the whole system-integration situation for managing containers with systemd-nspawn. it's giving infrastructure. ✨

🎀 Usage 🎀

okay so technically you can just start container-shell from a running system like any other program, but the main intend — and yes, that's the actual intent — is to use it over SSH. that way, otherwise unprivileged users get to manage containers without needing a regular shell login on the container server. the way that works?? literally genius. 😭💖

for SSH usage you should create an unprivileged user, like this:

sudo adduser --gecos "compute-tools,,," \
  --home /var/lib/open-infrastructure/container-shell \
  --shell /usr/bin/container-shell

then you can allow container-shell for specific SSH keys via /var/lib/compute-tools/container-shell/.ssh/authorized_keys, like so:

command="/usr/bin/container-shell",no-port-forwarding,no-X11-forwarding,\
  no-agent-forwarding,no-pty ssh-ed25519 [...]

look at that command= restriction doing its little main-character thing. 💅

🔒 Restricted shell 🔒

by default, container-shell grants any user that has access to it the ability to use all available container commands. generous! maybe too generous?? 🙈

through two corresponding environment variables, users can be allowed or disallowed from using specific container commands. and when you pair that with SSH, you can grant certain SSH keys (and by that, users) privileges to operate container servers without handing them root access, without giving them a login shell at all, and it prevents them from doing things they are not trusted to do. security, but make it cute. 🧚

💀 Example (blacklisting) 💀

to allow all commands except for removing and stopping containers, use this variable:

command="CONTAINER_COMMANDS_DISABLE='remove stop' \
  /usr/bin/container-shell",no-port-forwarding,no-X11-forwarding,\
  no-agent-forwarding,no-pty ssh-ed25519 [...]

no remove, no stop, no chaos. we love boundaries. 🎀

⭐ Example (whitelisting) ⭐

the other way around works too!! to disallow all commands except for listing containers and showing the compute-tools version, use this variable:

command="CONTAINER_COMMANDS_ENABLE='list version' \
  /usr/bin/container-shell",no-port-forwarding,no-X11-forwarding,\
  no-agent-forwarding,no-pty ssh-ed25519 [...]

list and version and that is IT. locked down, immaculate, periodt. ✨

---

👑 COMMANDS 👑

all container commands are available — go check container(1) for those, bestie. 📖

additionally, these commands are specific to container-shell:

• about — shows introduction (manpage).
• help — shows available commands within the container-shell.
• help COMMAND — shows help (manpage) for a specific container command. yes, help for your help. 🫶
• logout, exit — exits container-shell. bye babes!! 👋💖

---

🌈 SEE ALSO 🌈

• compute-tools(7)
• container(1)

go read them, iykyk. 📚

---

🌐 HOMEPAGE 🌐

more information about compute-tools and the Open Infrastructure project can be found on the homepage at https://open-infrastructure.net. 🦋

---

💌 CONTACT 💌

bug reports, feature requests, help, patches, support and everything else are welcome on the Open Infrastructure Software Mailing List <software@lists.open-infrastructure.net>. come say hi, we don't bite. 🍓

Debian specific bugs can also be reported in the Debian Bug Tracking System at https://bugs.debian.org.

---

💜 AUTHORS 💜

compute-tools were written by Daniel Baumann <daniel.baumann@open-infrastructure.net> and others. legends, honestly. 👑

---

okay that's the whole page!! go forth and manage your containers responsibly, bestie. 🧚✨

and that's a wrap — brought to you by Open Infrastructure on the compute-tools tip, straight out of the General Commands Manual, dated like every good manual page is. slay, stay safe, and always read your authorized_keys twice. 💅🎀🌸