cleanup
This commit is contained in:
parent
cc6d0f989d
commit
7f955b3923
3 changed files with 19 additions and 62 deletions
31
Dockerfile
31
Dockerfile
|
|
@ -3,48 +3,27 @@ FROM ubuntu:22.04
|
||||||
ENV DEBIAN_FRONTEND=noninteractive
|
ENV DEBIAN_FRONTEND=noninteractive
|
||||||
|
|
||||||
# Install base packages and enable the dosemu2 PPA
|
# Install base packages and enable the dosemu2 PPA
|
||||||
RUN apt-get update && \
|
RUN apt-get update && apt-get install -y --no-install-recommends software-properties-common gnupg openssh-server busybox-static sudo ca-certificates curl mtools unzip file xauth && add-apt-repository -y ppa:dosemu2/ppa && apt-get install -y --no-install-recommends dosemu2 && rm -rf /var/lib/apt/lists/*
|
||||||
apt-get install -y --no-install-recommends \
|
|
||||||
software-properties-common \
|
|
||||||
gnupg \
|
|
||||||
openssh-server \
|
|
||||||
busybox-static \
|
|
||||||
sudo \
|
|
||||||
ca-certificates \
|
|
||||||
curl \
|
|
||||||
mtools \
|
|
||||||
unzip \
|
|
||||||
file \
|
|
||||||
xauth \
|
|
||||||
&& add-apt-repository -y ppa:dosemu2/ppa && \
|
|
||||||
apt-get install -y --no-install-recommends \
|
|
||||||
dosemu2 \
|
|
||||||
&& rm -rf /var/lib/apt/lists/*
|
|
||||||
|
|
||||||
# Provide DOS wrapper, SvarDOS bootstrapper, and service supervisor
|
# Provide DOS wrapper, SvarDOS bootstrapper, and service supervisor
|
||||||
COPY scripts/dos-shell /usr/local/bin/dos-shell
|
COPY scripts/dos-shell /usr/local/bin/dos-shell
|
||||||
COPY scripts/prepare-svardos.sh /usr/local/bin/prepare-svardos
|
COPY scripts/prepare-svardos.sh /usr/local/bin/prepare-svardos
|
||||||
COPY scripts/start-services.sh /usr/local/bin/start-dos-services
|
COPY scripts/start-services.sh /usr/local/bin/start-dos-services
|
||||||
RUN chmod +x /usr/local/bin/dos-shell /usr/local/bin/start-dos-services /usr/local/bin/prepare-svardos && \
|
RUN chmod +x /usr/local/bin/dos-shell /usr/local/bin/start-dos-services /usr/local/bin/prepare-svardos && echo "/usr/local/bin/dos-shell" >> /etc/shells
|
||||||
echo "/usr/local/bin/dos-shell" >> /etc/shells
|
|
||||||
|
|
||||||
# Create sshd runtime directory
|
# Create sshd runtime directory
|
||||||
RUN mkdir -p /var/run/sshd
|
RUN mkdir -p /var/run/sshd
|
||||||
|
|
||||||
# Create dos user
|
# Create dos user
|
||||||
RUN useradd -m -s /usr/local/bin/dos-shell dosuser && \
|
RUN useradd -m -s /usr/local/bin/dos-shell dosuser && mkdir -p /home/dosuser/.ssh && chown -R dosuser:dosuser /home/dosuser && echo "dosuser:dosuser" | chpasswd
|
||||||
mkdir -p /home/dosuser/.ssh && chown -R dosuser:dosuser /home/dosuser && \
|
|
||||||
echo "dosuser:dosuser" | chpasswd
|
|
||||||
|
|
||||||
# Create directories for allowed DOS files, extra drives, and the C: drive mount
|
# Create directories for allowed DOS files, extra drives, and the C: drive mount
|
||||||
RUN mkdir -p /opt/allowed_repo /opt/dos_drives /cdrive /etc/dos_env /opt/svardos && \
|
RUN mkdir -p /opt/allowed_repo /opt/dos_drives /cdrive /etc/dos_env /opt/svardos && chown -R dosuser:dosuser /opt/allowed_repo /opt/dos_drives /cdrive
|
||||||
chown -R dosuser:dosuser /opt/allowed_repo /opt/dos_drives /cdrive
|
|
||||||
|
|
||||||
# Download and stage SvarDOS base files
|
# Download and stage SvarDOS base files
|
||||||
ARG SVARDOS_IMG_URL
|
ARG SVARDOS_IMG_URL
|
||||||
ENV SVARDOS_IMG_URL=${SVARDOS_IMG_URL}
|
ENV SVARDOS_IMG_URL=${SVARDOS_IMG_URL}
|
||||||
RUN /usr/local/bin/prepare-svardos && \
|
RUN /usr/local/bin/prepare-svardos && chown -R dosuser:dosuser /opt/svardos
|
||||||
chown -R dosuser:dosuser /opt/svardos
|
|
||||||
|
|
||||||
# Default allowed list (can be overridden with a bind mount)
|
# Default allowed list (can be overridden with a bind mount)
|
||||||
COPY config/dos_allowed /etc/dos_allowed
|
COPY config/dos_allowed /etc/dos_allowed
|
||||||
|
|
|
||||||
44
README.md
44
README.md
|
|
@ -1,4 +1,4 @@
|
||||||
# DOS Remote Environment Stack
|
# SvarBox
|
||||||
|
|
||||||
This repository packages a repeatable SvarDOS environment that can be exposed over SSH (with optional X forwarding) and telnet. It wraps the upstream `dosemu2` emulator with automation for bootstrapping media, distributing pre-approved files, and hardening the guest runtime so multiple users can log in without trampling each other.
|
This repository packages a repeatable SvarDOS environment that can be exposed over SSH (with optional X forwarding) and telnet. It wraps the upstream `dosemu2` emulator with automation for bootstrapping media, distributing pre-approved files, and hardening the guest runtime so multiple users can log in without trampling each other.
|
||||||
|
|
||||||
|
|
@ -22,12 +22,6 @@ The project is split into small, testable shell helpers plus a Docker image that
|
||||||
|
|
||||||
## Quick Start
|
## Quick Start
|
||||||
|
|
||||||
Requirements:
|
|
||||||
|
|
||||||
- Linux host with Docker 24+ (`docker compose` plugin included)
|
|
||||||
- X11 server on your workstation if you intend to use `ssh -X`
|
|
||||||
- Optional: PulseAudio/PipeWire socket forwarded if you want sound
|
|
||||||
|
|
||||||
Bring the stack up:
|
Bring the stack up:
|
||||||
|
|
||||||
```sh
|
```sh
|
||||||
|
|
@ -43,18 +37,6 @@ Default access:
|
||||||
|
|
||||||
Use `exit` from the DOS shell to terminate the session; the container keeps running for the next login.
|
Use `exit` from the DOS shell to terminate the session; the container keeps running for the next login.
|
||||||
|
|
||||||
## Repository Layout
|
|
||||||
|
|
||||||
| Path | Purpose |
|
|
||||||
|-----------------------|--------------------------------------------------------------------------------------------------|
|
|
||||||
| `Dockerfile` | Builds the Ubuntu 22.04 based image with dosemu2 and helper scripts. |
|
|
||||||
| `compose.yml` | Reference deployment that exposes SSH/Telnet and mounts custom content. |
|
|
||||||
| `scripts/` | Automation scripts (`dos-shell`, `prepare-svardos`, `start-services`). |
|
|
||||||
| `config/` | Baseline configuration for the container (`sshd_config`, `dos_allowed` allow-list). |
|
|
||||||
| `allowed_repo/` | Host directory whose contents are copied to `C:\` when permitted. |
|
|
||||||
| `dos_env/` | Optional templates for `AUTOEXEC.BAT` / `CONFIG.SYS`; copied on every login. |
|
|
||||||
| `docs/` | Room for auxiliary documentation (currently empty). |
|
|
||||||
|
|
||||||
All persistent user data inside the guest lives under `/home/dosuser/.dosemu`, which is created on first login.
|
All persistent user data inside the guest lives under `/home/dosuser/.dosemu`, which is created on first login.
|
||||||
|
|
||||||
## How the Container Boots
|
## How the Container Boots
|
||||||
|
|
@ -123,11 +105,11 @@ You can influence runtime behaviour with environment variables. Set them either
|
||||||
|
|
||||||
### Podman / Docker exec entrypoints
|
### Podman / Docker exec entrypoints
|
||||||
|
|
||||||
`dos-shell` remains the default login shell for `dosuser`, so a plain `podman exec -it dos-env dos-shell` (or `docker exec`) drops you straight into the DOS session. When you need a regular Linux shell in the same running container, reuse the wrapper but append `--linux-shell`:
|
`dos-shell` remains the default login shell for `dosuser`, so a plain `podman exec -it svarbox dos-shell` (or `docker exec`) drops you straight into the DOS session. When you need a regular Linux shell in the same running container, reuse the wrapper but append `--linux-shell`:
|
||||||
|
|
||||||
```sh
|
```sh
|
||||||
podman exec -it dos-env dos-shell --linux-shell # interactive bash as dosuser
|
podman exec -it svarbox dos-shell --linux-shell # interactive bash as dosuser
|
||||||
podman exec -it dos-env dos-shell --linux-shell "ls" # run a single command as dosuser
|
podman exec -it svarbox dos-shell --linux-shell "ls" # run a single command as dosuser
|
||||||
```
|
```
|
||||||
|
|
||||||
You can override which binary is used for the Linux side by setting `DOS_LINUX_SHELL` (defaults to `/bin/bash`).
|
You can override which binary is used for the Linux side by setting `DOS_LINUX_SHELL` (defaults to `/bin/bash`).
|
||||||
|
|
@ -138,8 +120,8 @@ You can override which binary is used for the Linux side by setting `DOS_LINUX_S
|
||||||
|
|
||||||
| Compose Variable | Default | Description |
|
| Compose Variable | Default | Description |
|
||||||
|--------------------------|---------------------|----------------------------------------------------------|
|
|--------------------------|---------------------|----------------------------------------------------------|
|
||||||
| `DOS_IMAGE_NAME` | `dos-env` | Tag assigned to the built image. |
|
| `DOS_IMAGE_NAME` | `svarbox` | Tag assigned to the built image. |
|
||||||
| `DOS_CONTAINER_NAME` | `dos-env` | Name of the running container. |
|
| `DOS_CONTAINER_NAME` | `svarbox` | Name of the running container. |
|
||||||
| `DOS_SSH_PORT` | `2222` | Host port forwarded to container port 22. |
|
| `DOS_SSH_PORT` | `2222` | Host port forwarded to container port 22. |
|
||||||
| `DOS_TELNET_PORT` | `2323` | Host port forwarded to container port 23. |
|
| `DOS_TELNET_PORT` | `2323` | Host port forwarded to container port 23. |
|
||||||
| `ENABLE_TELNET` | `1` | Toggle BusyBox telnetd. |
|
| `ENABLE_TELNET` | `1` | Toggle BusyBox telnetd. |
|
||||||
|
|
@ -173,7 +155,7 @@ During image build the script also patches `INSTALL.BAT` and `AUTOEXEC.BAT` to w
|
||||||
If you want to refresh the base files inside a running container:
|
If you want to refresh the base files inside a running container:
|
||||||
|
|
||||||
```sh
|
```sh
|
||||||
docker exec -e SVARDOS_REFRESH=1 dos-env /usr/local/bin/prepare-svardos
|
docker exec -e SVARDOS_REFRESH=1 svarbox /usr/local/bin/prepare-svardos
|
||||||
```
|
```
|
||||||
|
|
||||||
Subsequent logins should pick up the new contents once you also export `DOS_FORCE_INSTALL=1`.
|
Subsequent logins should pick up the new contents once you also export `DOS_FORCE_INSTALL=1`.
|
||||||
|
|
@ -183,13 +165,13 @@ Subsequent logins should pick up the new contents once you also export `DOS_FORC
|
||||||
You can launch the container directly:
|
You can launch the container directly:
|
||||||
|
|
||||||
```sh
|
```sh
|
||||||
docker build -t dos-env .
|
docker build -t svarbox .
|
||||||
docker run -d --name dos-env \
|
docker run -d --name svarbox \
|
||||||
-p 2222:22 -p 2323:23 \
|
-p 2222:22 -p 2323:23 \
|
||||||
-v "$(pwd)/allowed_repo:/opt/allowed_repo" \
|
-v "$(pwd)/allowed_repo:/opt/allowed_repo" \
|
||||||
-v "$(pwd)/config/dos_allowed:/etc/dos_allowed:ro" \
|
-v "$(pwd)/config/dos_allowed:/etc/dos_allowed:ro" \
|
||||||
-v "$(pwd)/dos_env:/etc/dos_env:ro" \
|
-v "$(pwd)/dos_env:/etc/dos_env:ro" \
|
||||||
dos-env
|
svarbox
|
||||||
```
|
```
|
||||||
|
|
||||||
To override behaviour, append `-e` flags:
|
To override behaviour, append `-e` flags:
|
||||||
|
|
@ -217,7 +199,7 @@ Enemy separation: `dos-shell` prints the config overrides it applies; review tho
|
||||||
- **Upgrading dosemu2/SvarDOS:** rebuild the image (`docker compose build`) after adjusting `Dockerfile` or `SVARDOS_IMG_URL`.
|
- **Upgrading dosemu2/SvarDOS:** rebuild the image (`docker compose build`) after adjusting `Dockerfile` or `SVARDOS_IMG_URL`.
|
||||||
- **Resetting to stock files:** remove `/home/dosuser/.dosemu` or log in with `DOS_FORCE_INSTALL=1`.
|
- **Resetting to stock files:** remove `/home/dosuser/.dosemu` or log in with `DOS_FORCE_INSTALL=1`.
|
||||||
- **Extending the allow-list:** add entries to `config/dos_allowed` (one per line) or switch the mode to `all`.
|
- **Extending the allow-list:** add entries to `config/dos_allowed` (one per line) or switch the mode to `all`.
|
||||||
- **Audit logs:** `sshd` is configured to run in debug mode (`-e`); use `docker logs dos-env` for a quick view.
|
- **Audit logs:** `sshd` is configured to run in debug mode (`-e`); use `docker logs svarbox` for a quick view.
|
||||||
|
|
||||||
## Security Notes
|
## Security Notes
|
||||||
|
|
||||||
|
|
@ -225,7 +207,3 @@ Enemy separation: `dos-shell` prints the config overrides it applies; review tho
|
||||||
- When audio is muted the script points libao to the `null` backend to avoid opening `/dev/dsp` or Pulse pipes.
|
- When audio is muted the script points libao to the `null` backend to avoid opening `/dev/dsp` or Pulse pipes.
|
||||||
- Landlock sandboxing provides extra filesystem isolation when available. The script downgrades gracefully when the kernel is too old.
|
- Landlock sandboxing provides extra filesystem isolation when available. The script downgrades gracefully when the kernel is too old.
|
||||||
- The default credentials are intentionally simple for local development. Change them (or add public keys) before exposing the service.
|
- The default credentials are intentionally simple for local development. Change them (or add public keys) before exposing the service.
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
For questions or contributions, open an issue or send a patch – the shell scripts are deliberately compact so it is easy to audit every change.
|
|
||||||
|
|
|
||||||
|
|
@ -4,8 +4,8 @@ services:
|
||||||
context: .
|
context: .
|
||||||
args:
|
args:
|
||||||
SVARDOS_IMG_URL: ${SVARDOS_IMG_URL:-}
|
SVARDOS_IMG_URL: ${SVARDOS_IMG_URL:-}
|
||||||
image: ${DOS_IMAGE_NAME:-dos-env}
|
image: ${DOS_IMAGE_NAME:-svarbox}
|
||||||
container_name: ${DOS_CONTAINER_NAME:-dos-env}
|
container_name: ${DOS_CONTAINER_NAME:-svarbox}
|
||||||
ports:
|
ports:
|
||||||
- "${DOS_SSH_PORT:-2222}:22"
|
- "${DOS_SSH_PORT:-2222}:22"
|
||||||
- "${DOS_TELNET_PORT:-2323}:23"
|
- "${DOS_TELNET_PORT:-2323}:23"
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue