Distrobox: sudo without sudo

Author: Sasank Chilamkurthy

Distrobox is one of my favorite tools on JOHNAIC. It lets you create lightweight Linux environments based on any distribution you like: Ubuntu, Debian, Fedora, openSUSE, and many more. The killer feature is that you can use sudo inside a Distrobox even if your account does not have sudo on the host system.

How It Works

Containers are usually isolated from the host. They have their own filesystem, their own network namespace, and their own process tree. This isolation is great for running production services, but it can feel restrictive when you want to use a container as a development environment.

Distrobox takes a different approach. It creates a container that is tightly integrated with the host:

• Your home directory is automatically mounted inside the container.
• Container ports are bound to the host without extra configuration.
• Your username and user ID are preserved.
• You can install packages using the container's package manager because you have sudo inside the box.

Under the hood, Distrobox uses a container engine, typically Podman on JOHNAIC. Because Podman is rootless, the sudo inside Distrobox is scoped to the container only. You can install htop, Redis, or even a database inside your box without risking the host system.

A Quick Example

Creating a new Distrobox takes a single command. You choose a name, pick an image, and optionally pass extra flags for GPU access. Once created, entering the box is as simple as running distrobox enter followed by the name.

Inside the box, everything feels familiar. Your downloads folder is there. Your shell history is there. You can run apt install, dnf install, or whatever package manager your chosen distribution uses. The only difference is the hostname in your prompt.

When you exit, you are back on the host. Try sudo there, and it will be refused. The privilege escalation existed only inside the Distrobox.

Systemd Inside Distrobox

Some applications expect a full init system. By default, many container images do not include systemd, which can cause installation errors for services like Caddy, Redis, or PostgreSQL.

Distrobox solves this with an init mode. You create the box with the --init flag and install systemd as an additional package. Once inside, you can start services with systemctl just as you would on a regular server. This makes Distrobox suitable not only for development but also for running persistent personal services.

Why This Matters

Distrobox gives developers the flexibility they crave while preserving the security model of the host. It is the missing link between the isolation of containers and the comfort of a full Linux desktop. On JOHNAIC, it comes preinstalled and preconfigured so you can start using it immediately.

Published on 13/10/24