Running sshd inside bubblewrap

[raldone01]

I am trying to run sshd in bubblewrap.

It fails on connection with this:

chown(/dev/pts/1, 1001, 5) failed: Operation not permitted

It used to work in previous versions of bubblewrap.

Here is roughly how I am running it:

# Start building the bwrap arguments array
# We run as root, so we map the host UID 0 to container UID 0
BWRAP_ARGS=(
    # Can't use --unshare-all because we need to share user and it doesn't have a flag for that
    --unshare-ipc
    --unshare-pid
    --unshare-uts
    --unshare-cgroup
    # We must SHARE net to allow SSHD to listen on the host interface
    --share-net
    #--share-user

    # Process management
    --die-with-parent
    --new-session

    # Base Filesystem
    --bind "$CHROOT_DIR" /

    # System Directories
    --bind /proc /proc          # Bind container /proc
    --dev-bind /dev /dev        # Bind container /dev (needed for GPU devices)
    --bind /sys /sys            # Bind container /sys (needed for driver info)
    --tmpfs /tmp                # Clean tmp
    --tmpfs /run                # Clean run
    --dir /run/sshd             # Ensure directory for sshd socket exists

    # Capabilities
    --cap-add CAP_SYS_CHROOT
    --cap-add CAP_SETUID
    --cap-add CAP_SETGID

    # Data Persistence
    --bind /data/home /home
)

...

exec unshare --map-root-user --map-auto \
        bwrap "${BWRAP_ARGS[@]}" \
        /usr/sbin/sshd -D -e -o LogLevel=VERBOSE

Am I missing some new flag?
I can provide more information if needed.
Thanks for your help.

[smcv]

I am trying to run sshd in bubblewrap

bubblewrap isn't designed for running system-level components. Consider using podman, Docker, incus, systemd-nspawn, or even systemd unit hardening options instead.

[raldone01]

This is inside docker too.
What if we wanted to though? ;)

Any ideas?