Request classic confinement for instant-lab

store-requests classic-confinement
1

I request classic confinement for instant-lab.

Instant Lab is an Apache-2.0 Docker-based cybersecurity training lab for Raspberry Pi and Ubuntu. It launches security tools, intentionally vulnerable web applications, ELK, and Wazuh through an interactive Bash menu.

Classic confinement is required because the application must:

  • Access the host Docker daemon
  • Create and manage Docker containers and networks
  • Use host networking and local service ports
  • Install Docker dependencies when requested by the user
  • Configure vm.max_map_count for the Wazuh indexer
  • Start services that require host-level Docker access

The application is intended only for authorized security training in an isolated lab. The README documents the risks and usage requirements.

Snap name: instant-lab

Request for Classic Confinement: instant-lab
2

This request has been added to the queue for review by the @reviewers team.

3

All this should be possible via strict confinement, please see the docs about docker and snaps:

https://documentation.ubuntu.com/core/explanation/docker-companion-snap/#explanation-docker-companion-snap

https://documentation.ubuntu.com/core/how-to-guides/container-deployment/package-docker-images-in-a-snap/

https://documentation.ubuntu.com/core/how-to-guides/container-deployment/build-an-image-for-docker-deployment/

Regarding the non docker related bits you should run snappy-debug against your strictly confined snap, that should suggest the correct interfaces.

also, please see the list of supported categories, your snap must clearly fit into one of them to be considered for classic confinement:

4

Thank you. I will redesign Instant Lab as a strict-confinement Docker companion Snap using the Docker Snap interfaces.

I will remove Docker installation from the Snap, require Docker separately, move the Wazuh vm.max_map_count setup to documented host prerequisites, and test the required interfaces with snappy-debug.

I will report back with the strict-confinement test results before requesting classic confinement again.

1 Like
5

I see you have switched to an auto-connection request here, so I am considering this closed. Thank you!

1 Like