Conty - easy to use non-root container (and sandbox) with benefits of flatpak and AppImage

[Grey]

There is such a wonderful person, Kron4ek - the author of Wine builds for every taste, as well as a frequenter of the largest Russian torrent tracker dealing with native and ported Linux games.
This time he's trying to do Conty - 'easy to use non-root container compressed into squashfs and packed into a single executable that runs on most Linux distros and combines benefits of flatpak and AppImage'.
Perhaps it will be interesting for someone to watch, or maybe it will be useful for work(steal a couple of ideas) or entertainment.

[mikeslr]

Appears to be a great implementation of an excellent idea. 1.5 Gb is certainly not unreasonable on current hardware. But more suited for 'regular' Linux distros than for Puppys which still strive to provide the most 'bang for the buck' in the least space.

My feeling is that under Puppies the primary reason for isolating applications is to prevent the contamination of one's system thru web-facing applications. Watchdog-Mike Walsh's chroot applications accomplish that in a third of the space required by Conty. Perhaps --hint, hint-- a 64-bit implementation will become available before 32-bit Web-browsers 'bite the dust'.

Perhaps the only other application requiring isolation is the implementation of Wine. It creates the target for Windows malware without facilitating use of the shields of Windows' anti-malware programs.
One of the modules either not builtin or otherwise crippled in chroots is --I think, but may be wrong-- fuse with its ability to mount other file systems. AFAICT, Wine AppImages don't work. Wine pets --while providing the primary components for Wine's environment-- still require configuration to create that environment. And, I don't think that creation will survive in the chroot folder a reboot of the system. [That's a guess: will have to experiment]. Built externally, a transfer to the chroot folder appears to be difficult/time-consuming if even possible.

But I wonder if Wine-portable would work. As a portable it can be located anywhere including /cont/opt. And while portables package wine as an SFS, I don't think it actually makes use of the 'merge file-system' generally associated with SFSes. Rather, I think it's just employed as a convenient packaging mechanism whose files are symlinked to the operating system. Tested; doesn't work.

Sorry about hijacking the thread. But examining the discussion about wine under conty on github got me thinking and I wanted to preserve my thoughts before they evaporated.

[Grey]

But examining the discussion about wine under conty on github got me thinking and I wanted to preserve my thoughts before they evaporated.

You are reacting correctly. So far we are just reading and thinking. This is for general information only. I am not advocating to use immediately

[wiak]

Interesting it uses Arch Linux... big indeed though.

Don't mean to derail the thread topic but as I've said long time back:

Void Linux optionally uses a lean/lightweight container implementation (as a Void package)

https://github.com/void-linux/void-pack ... s/template
https://github.com/arachsys/containers

That one seems pretty light-weight. Don't know if it could be used with Puppy, but being light-weight it would be good if it did (Void is multiuser system with namespace support and so not sure if Puppy system has the facilities for it).

arachsys/containers will certainly work with WeeDogLinux_Void systems of course, and probably with WDL_Arch and WDL_Debian-based systems also.
You can alternatively use somewhat larger and more complicated LXC with Void Linux (and thus also WDL_Void).

Anyway, just a related-comment, but back to Conty discussion to see if anyone tries it and if it works on distros here and how useful it is.

[rockedge]

I have used Void Linux or a really light WeeDog in a non-root container with monster success.

I experiment a lot with using the mount scripts from FirstRib to start a WeeDog-Void and then in WeeDog logging in as user "bruiser" which in WeeDog I set up as a real user.

Try opening more than one terminal as a separate OS and each as another user...and all being held together by Bionic64 running as the usual root

[mikewalsh]

My feeling is that under Puppies the primary reason for isolating applications is to prevent the contamination of one's system thru web-facing applications. Watchdog-Mike Walsh's chroot applications accomplish that in a third of the space required by Conty. Perhaps --hint, hint-- a 64-bit implementation will become available before 32-bit Web-browsers 'bite the dust'.

@mikeslr :-

Not entirely sure a 64-bit chroot is in fact necessary ATM, Mike. We haven't yet reached the stage where 64-bit Puppies won't run modern browsers. I have a Tahr64 multi-session DVD I set-up for those rare occasions I need to investigate a problem therein.....and current Chrome-portable still runs fine with it.

Now, I freely admit I use a 64-bit Xenialpup chroot with my 'daily driver', jrb's lite spin on BK's Quirky64 April 701. But the primary reason for this is not web-related; more to do with

• a ) Wishing to run newer applications that Quirky will let me do natively, and

• b ) The fact that some items require the OpenGL stuff to work.....and I've tracked down the fact that this ain't working to a "mis-match" between my Nvidia GPU and multiple Quirky components (which I can't be bothered to correct). Quirky's OpenGL will like as not run fine if I remove the Nvidia card and revert back to the on-die Intel UHD610, but I then have the issue of having to re-set those Pups running the Nvidia drivers BACK to the in-kernel Intel ones. Again, I can't be arsed to; every other Pup works fine, Quirky's the exception rather than the rule, hence the Xenial64 chroot. For ME, this is a 'one-off' custom work-around.

• c ) In addition to the above, with any 'buntu-based chroot there's the additional complication of the multi-arch stuff.....catered for by the i386-linux-gnu and x86_64-linux-gnu sym-linked folders. It's summat of a PITA to set-up correctly..!

Works for me, though.

Mike.

[mikewalsh]

Just a "follow-up" on what t'other Mike was saying about the WINE AppImages.

From my recent experience, the WINE AppImages that trister found & reported on DO seem to work very well indeed. Purely for experimentation purposes, I've set up a Fossapup64 multi-session DVD which, after some light customization in a single 'saved-folder', I now run without further saves. Along with this, I use a dedicated flash-drive which contains a number of my portable applications (mainly browsers, along with Thunderbird, FreeTube, Skype and Zoom), and a bunch of AppImages.

It also contains a transplanted version of my 'external' WINE setup (AppImage + 'prefix') that I now use with all the 64-bit occupants of the kennels. This thing is so simple to use; it requires three sym-links from the AppImage into /usr/bin as 'wine', 'wine32' and 'wineserver'. All it then requires is a link, from the prefix into root as /root/.wine32, and an additional sym-link from this to /root/.wine (thus enabling all my existing applications to continue to work).

It works so well that I've created a pair of wee scripts to link/unlink the WINE set-up at the start and end of each session. And this way - given that the flash-drive in use is a 64 GB one, thus tons of room even for the AT&T 'natural' voices that the TextAloud! text-to-speech program uses (these average out at anywhere between 5-700 MB each) - the entire thing is self-contained AND 'portable'. It's turned into yet another successful alternative to Shinobar's orignal WINE-portable.

I have an entire directory-full of MenuEntry .pets I put together for all the WINE items I use. These are installed in the multi-session DVD, and simply remain where they are until called on to fire apps up from the 'linked' external WINE setup.

Works nicely as far as I'm concerned..!!

Mike.

[Grey]

given that the flash-drive in use is a 64 GB one

I was just thinking today which flash drive to buy next Monday - 32, 128 or 64. Want to buy usb3.0 for inhumane (indoge ?!) experiments with some versions of Puppy. Will follow your example and take 64.

[mikewalsh]

@Grey :-

Hah! Actually, I'm in a bit of a dilemna myself.

128 GB was the max available size of the "old" USB 3.0 SanDisk Ultra 'Fit' nano-sized thumb drives. I've got a small collection of these.

The "new" version - the USB 3.2 SanDisk Ultra 'Fit' thumb drives, as well as having a re-design are now available in MUCH larger capacities. I'm debating whether to go for a 256 GB, or the "big boy"......a whopping 512 GB. And the price of this 512 GB is around the same as what I paid for the 128 GB older models a few years back.

Decisions, decisions.....

-------------------------------------------------------

The main reason I want one is for the old Dell lappie. With only 2 USB 2.0 ports, I need to keep one free for a hub (or whatever).....but the 512GB could be left permanently plugged-in, they're that tiny. It's a bit easier to work with than needing to plug a portable HDD in all the time. If I want to take the old girl outside of a summer's evening, I can have every bit of my music, video and image collections on tap.....with tons of room to spare. And STILL have one port spare for a mouse, if I want.....

Even though the Dell is limited to USB 2.0, I've proved, over & again, that a USB 3.0 drive still transfers data quite a bit faster thru a USB 2.0 port than a USB 2.0 drive will. Probably because it gets a lot closer to the USB 2.0 standard's "max" of 480 MB/s.....

------------------------------------------------------

64GB is a decent size for most applications. I've got several of those, too..!

Mike.

[Grey]

64GB is a decent size for most applications. I've got several of those, too..!

I decided to stick with the SILICON POWER Marvel M01 64GB flash drive. It has an activity indicator - a blinking LED is a prerequisite for me to see what is happening from a distance. In addition, SP seems to be still making its own memory chips. Last time I bought a Transcend flash drive - never again!

Even though the Dell is limited to USB 2.0, I've proved, over & again, that a USB 3.0 drive still transfers data quite a bit faster thru a USB 2.0 port than a USB 2.0 drive will. Probably because it gets a lot closer to the USB 2.0 standard's "max" of 480 MB/s.....

Yes, I have the same impression.

While looking for flash drives, I looked at the prices of video cards... and got scared. What happened after New Year that Nvidia 1050ti now costs twice as much ?! Again they will say a fire at the factory.

[Clarity]

My test over the past 3 years is that USB drives "STINK!" Reads is bad and writes are terrible. Failures are high and filesystem wacking is all too often requiring filesystem rebuilds. The ONLY benefit they provide is for initial booting of a PC. Beyond that a waste of time and money. ... Oh, one more benefit, I can put in my pocket; namely tiny portability.

The performance is horrible barely matching spinning drives on motherboard PCI.

My cost analysis suggest internal SSD/NVME/M.2 all match what one wants for normal system operations...including backup on NAS. @bigpup come to mind where, instead of USBs, he partitions a drive as often as he needs thereby gaining performance with little maintenance. I can only assume that he, too, saw benefit in that arrangement vs many/multiple USBs.

If and when the manufacturers get USBs to USB 3.2 2X2 connection ("thunderbolt") will they be worth if performance and consistency accompanies the new sticks when they are available.

I just order 6 of them of varying sizes from 64GB to 128GB last week, and have send 5 back for refunds. 1 had a read performance of 130 while its write performance was 6, taking forever to write an mere ISO to the filesystem. So, for example, as a boot unit is it fine, but if you are writing ISOs to it for tests at a rate of 1-2 per/week, its NOT worth the wait.

Sorry for sounding off, but, after the last weeks purchases and testings (and knowing better while wishing things had changed from last year) I will continue to use the partitioning approaches.

I apolpgize for this post as it is off-topic. I am not trying to derail, but, USB behaviors and manufacturer lies (except for Samsung) and recent tests have me in a pissy mood of disappointment with them. Most of us are NOT willing to pay Samsung prices, but, if you want foolproof reliability, that the ONLY way to go for any USB troublefree direction with good performance for a USB 3.+, currently.

[mikewalsh]

@Clarity :-

Sorry to hear of your 'disenchantment' with USB drives. I must have been lucky, viz:-

• Brand loyalty - I've always been happy with SanDisk, and they've rarely let me down, and

• Perhaps lower 'expectations' in the first place.

The current revision of the SanDisk Ultra 'Fit' drives - 'nano'-sized with a USB 3.2 interface - turn in a regular, consistent 95-110 MB/s 'read' and 30-35 MB/s 'write' performance. Since I've never bothered with these ultra-fast Nvme SSDs - I'm not the type looking to squeeze out the very last drop of performance from a system; Puppy itself is plenty fast enough for me on standard HDDs - I'm in the fortunate position of not being disillusioned, because I've never known that level of performance......therefore I don't feel as though I've "lost" anything. Frankly, I don't see the need to do everything faster & faster all the time.....

....but that's just me.

I'm 'savvy' enough to be able to research, select and purchase new items of hardware if, as & when necessary. At the end of the day, however, I'm content to get a handful of systems set-up exactly the way I want them.....and then to USE them on a regular basis. Not keep constantly titivating/experimenting for the sake of it.....but then, we all have different goals for what we want to achieve. I would no more find fault with YOUR aims than I would expect you to find fault with MINE.

I'm posting this from a 'full' install of Zorin Core OS 15.3, installed to one of the above-mentioned SanDisk USB drives. Anyone running this, not knowing this was installed to USB, would be none the wiser.....and would assume it to be installed to internal HDD in the normal way. That's how responsive these things are.

(I will 'elucidate' on ONE point; I rarely use USB drives as actual 'system' drives. 9 times out of 10 I'm using them as 'Data' drives.....more for permanent storage than anything else. Zorin OS is one of the very few exceptions to this 'rule'; I've been playing about with various releases of this for the last 7 or 8 years, and prefer to run it from a different drive to my internal system drives; I do NOT wish to end up with cross-contamination of Grub4DOS with the bloated monstrosity that calls itself GRUB2 - which I absolutely loathe.)

Mike.

[Clarity]

GRUB2 "bloathed"? It does everything a boot-time manager is suppose to with EXCELLENT debug capability and flexible enough to allow Linux command use to "program" for capabilities beyond; which has inspired many developers to use for our boot benefits; all of this while the world's developers continues to keep it current with start-ups, manufacturer motherboard and disk changes, fixes, and boot needs. Yes, it does offer "way more" than the capabiliity of GRUB4DOS.

Puppy's current implementations for booting gives us that (And IMHO, it is THE best combinations offered, thus far).

Not trying to convince you as I have no stake in this except to boot when it is enclosed by distro developers, i.e. Debian and beyond.

But, like everything, we humans have preferences.

Ediited: The above is off-topic in my opinion; and I should not have commented here. I apologize to the author and any others.

On another note about Containers, it is looking more and more that Containers is how many/most future distros will be implementing system's operational safeguards going forward in time. This will continue until Quantum becomes mainstream over the next 2 decades. I wont be around, but, it is starting to progress rapidly. Kinda reminds me of the days when computers started in the 60s-70s with competing technological offerings and many manufacturers over those years..

[Grey]

Conty now contains fresh versions of such emulators as Dolphin, RetroArch, PPSSPP (OpenJDK, Firefox, PCManFM, Wine-Staging-TkG, Steam, Lutris, PlayOnLinux, etc... have not gone anywhere). The current version (1.17) contains the Nvidia driver version 470.74. In order for Opengl and Vulkan programs to work in Fossapup, I had to install the same driver on the main system. Everything works fine now
Launching the PCManFM file manager:

Code: Select all

#!/bin/sh
export ALLOW_ROOT=1
./conty.sh pcmanfm
#export NVIDIA_FIX=1
#./conty.sh --help
#./conty.sh dolphin-emu
#./conty.sh retroarch
#./conty.sh firefox
#./conty.sh glxinfo -B
#./conty.sh vulkaninfo | less

[Grey]

Somewhere on the forum recently discussed btop (resource monitor). It cannot be compiled in the usual way, for example in Fossapup. For this reason:

For compilation GCC 10 is required, GCC 11 preferred.

Fossapup has version 9.3.0.

But with Conty you can. It has GCC version 11.1.0, which is the preferred one. For example like this:

Code: Select all

export ALLOW_ROOT=1
LD_PRELOAD= /mnt/sdb2/Conty/conty.sh make

Of course, after compiling, Fossapup cannot run the binary:

libc.so.6 (GLIBC_2.32) => not found
libstdc++.so.6 (GLIBCXX_3.4.29) => not found

Therefore, we need to run our fresh btop again using Conty:

Code: Select all

export ALLOW_ROOT=1
LD_PRELOAD= /mnt/sdb2/Conty/conty.sh ./btop

It's even better than I thought

btop_conty_fossapup.gif (93.74 KiB) Viewed 2251 times

[Grey]

New version of Conty (1.18). There are a lot of additions related to the launch of games. Added:
Minigalaxy (simple GOG client for Linux), GameHub (store your games from different platforms), MultiMC (custom launcher for Minecraft), Legendary (open-source game launcher for Epic Games platform) and Gamescope (SteamOS session compositing window manager).
These two programs probably don't need any introduction: OBS Studio and Youtube-dl.
And, to those that were already there, another emulator was added. PCSX2 (PlayStation 2).

[Grey]

Arch Linux, followed by Conty, switched to Nvidia driver version 495.44.

In order for hardware acceleration and Vulkan to work, it is necessary that the versions of the Nvidia driver in system (Fossapup) and in Conty itself match. I'm tired of reinstalling the driver to the latest one. Therefore, I will tell you how to rebuild Conty with any driver inside. For example, 470.74.

There are scripts on Github (link in the first post). We need to change create-arch-bootstrap.sh
1. Open it in Geany and look for the string:

Code: Select all

run_in_chroot pacman --noconfirm --needed -S ${packagelist}

AFTER this line, add two lines:

Code: Select all

run_in_chroot pacman --noconfirm -U 'https://archive.archlinux.org/packages/n/nvidia-utils/nvidia-utils-470.74-1-x86_64.pkg.tar.zst'
run_in_chroot pacman --noconfirm -U 'https://archive.archlinux.org/packages/l/lib32-nvidia-utils/lib32-nvidia-utils-470.74-1-x86_64.pkg.tar.zst'

Why? Because Arch Linux sends old versions of drivers to the archive. That's where we take them from. Just replace 470.74 with your version.

2. Remove (delete) from the video_pkgs variable: nvidia-utils, lib32-nvidia-utils and nvidia-prime.
These two steps can be performed in reverse order.
We save the changes and run the script (in terminal, of course).

3. Launch create-conty.sh, we are waiting a little and we are going to have a Conty with the right drivers.
We check like this ./conty.sh glxinfo -B or like that ./conty.sh vulkaninfo | less or even ./conty.sh vkcube

With a good processor and Internet, the first two steps need 4 minutes. One more minute on the third point.

Next time, when laziness goes away, I'll tell you how to reduce the size of Conty

[Grey]

Oh, I forgot, I promised to tell you about improving Conty compression.

To do this, you need to change the file create-conty.sh, which is located on the project page on GitHub. We find the tenth and eleventh (10 & 11) lines and change them to these:

Code: Select all

squashfs_compressor="zstd"
squashfs_compressor_arguments="-b 1M -comp ${squashfs_compressor} -Xcompression-level 19"

After that, you can build a project and the container will be assembled in a smaller size.

[Grey]

Addition to the previous post. The second way to reduce the size is to remove unnecessary programs in the middle of the script create-arch-bootstrap.sh

Well, for Wine lovers. Bottles has been added to Conty (on my initiative ). This is the Wine prefixes manager. Integration with the built-in PCManFM via the context menu.

[Grey]

The Blanket program was born not so long ago. Yes, of course, the program is far from Aura in terms of capabilities. But still...

I tried running it in Fossapup. Results... On the third attempt, I launched it (hello, Python), but without sound. Then laziness attacked me and I decided to run it from Conty

So, I prescribed a blanket in the middle of the create-arch-bootstrap.sh script. Reassembled Conty and... It didn't start Then I overcame laziness for a minute and figured out what to do. It is launched using:

Code: Select all

export $(dbus-launch)

It turned out that the famous KMahjongg from KDE can be launched from Conty in the same way

Application. Blanket allows you to add YOUR OWN sounds. Therefore, we add a quiet romance or ballad (not heavy metal ) and play the song itself plus the sounds of the train, thunderstorms and rain. You can feel like riding a train on a rainy day and listening to a calm song. I believe that such programs are still able to cure nerves damaged by the shit that is happening in this World.

blanket.png (87.59 KiB) Viewed 2043 times

[Grey]

I finally tried to build Conty with DwarFS instead of SquashFS on a local machine. It turned out only on the third attempt, but it turned out Well, it really seems DwarFS is faster, operations are performed smoother and faster. And better compression.

From other news. In ready-made assemblies, there is now an option in which only Wine is built in. I don't know, In my opinion this is an excess. But I'm just saying that it's there, and whether someone will need it or not is another question.

Since Arch is used, any version of Conty now has Wine version 8.xx (Staging).

A small hint on usage (in Fossapup). It is best to run the built-in PCManFM with certain parameters, and programs or games are already from its environment. In addition, you need to bind the folder under HomeDir, because we have root and some programs (for example Geany and Bless) cannot save and find their settings at startup. It is convenient that you can programmatically disable the Internet (especially for pirated soft ).
For example , you can do this:

Code: Select all

#!/bin/sh
export ALLOW_ROOT=1
export HOME_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"/ContyHomeDir
#export SANDBOX=1
#export SANDBOX_LEVEL=1
#export DISABLE_NET=1

LD_PRELOAD= "$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"/conty/conty.sh --bind "$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"/ContyHomeDir/ ~/ pcmanfm

I tried to play Into the Breach. Conty and its built-in Wine coped with the task perfectly. Nvidia drivers should still match by version (inside Conty and in the system itself)
A good little strategy game, twice I even got a headache from miscalculating moves And even 64 cells, as in chess.
I have the last move. The situation is not easy, but I hope for my favorite artillery mech and its ability to push the enemy into neighboring cells:

into2.gif (73.82 KiB) Viewed 1689 times

[Grey]

Today I'm just reading the forum from an old computer. I found Mike's reasoning:

I've literally lost track of the number of new users who come to Puppy, and can't make out why Puppy/Puppy-related distros aren't simply a clone of EVERY other distro out there. How often have I heard plaintive demands for Synaptic & "apt-get", etc?

I will agree with him in this thread, since it is neutral (EasyOS there).
Well... yes. There is a threat to simply "get lost" among the rest of the distros, lose at least some individuality & all that sort of stuff.

Why from an old computer? & why am I today very angry at Conty?
Another misfortune happened. A game (Atomic Heart) about "robots & the alternative USSR" has just been released & the pirates distributed a version for developers yesterday. I didn't expect such a reaction rate from them.
Unfortunately, the game has started in Fossapup & is working with Conty + Wine + DXVK. I wish I hadn't tried
As a result, my nephew & his friends "occupied" the main computer & all my work & tests were simply paralyzed by this event.

What a klutz they are They need to play smart strategies, not this... (at this point I have to tap my cane on the floor and snap my false teeth )
Okay, I'll give them a couple of days & then I'll kick them to hell.