unable to run sinfonia application on Ubuntu 24.04

[jaharkes]

openapi-core validation is broken for at least python 3.12.

To upgrade to a working version we need to drop python 3.7 support and switch from Spec.create to Spec.from_dict. tests succeed but still getting deprecation warnings. Also mypy seems broken.

However we can't deploy yet because there is a deeper permission problem with namespaces and uid mapping that probably needs to be resolved in wireguard4netns first.

[jaharkes]

More info, Ubuntu 23.10 limited access to unprivileged user namespaces for security reasons

https://ubuntu.com/blog/ubuntu-23-10-restricted-unprivileged-user-namespaces

Solutions seem to be,

• Disabling the lockdown setting with sysctl (kernel.apparmor_restrict_unprivileged_{unconfined,userns})
• Using apparmor profiles for the applications that need userns access. In our case we would need to have a profile for /usr/bin/unshare.
• There is an existing exception for rootlesskit so we could see if that can help in any way. It looks like both unshare and bwrap (bubblewrap) do not have an apparmor profile.
• Some people were suggesting using unshare to set up the initial namespace with no special uid remapping and then using nsenter to perform the bind mounts and other privileged operations, I tried some but haven't had much success with that approach yet, but it looks like it would allow us to run the frontend application as a regular user instead of pseudo root user so it may be interesting to dig a bit deeper on that.
• We could make our own helper process that only does the few steps that we currently need to do using the fakeroot privileges we get from the user namespace; create a new network and mount namespace, instantiate a tun/tap interface that we can bind to wireguard-go outside the container and replace /etc/resolv.conf to point at the backend name server. By limiting what we do we make it easier for analyze for possible security flaws and can be more confident giving it apparmor profiles, specific capabilities, or setuid root access.

[jaharkes]

Additional info

https://discourse.ubuntu.com/t/understanding-apparmor-user-namespace-restriction/58007