• 2 Posts
  • 171 Comments
Joined 1 year ago
cake
Cake day: September 7th, 2024

help-circle



  • docker run --rm -it --privileged --pid=host debian:12 nsenter -a -t1 "$(which bash)"

    If your user is in the docker group, and you are not running rootless Docker, this command opens a bash shell as root.

    How it works:

    • docker run --rm -it creates a temporary container and attaches it to the running terminal
    • --privileged disables some of the container’s protections
    • --pid=host attaches the container to the host’s PID namespace, allowing it to access all running processes
    • debian:12 uses the Debian 12 image
    • nsenter -a -t1 enters all the namespaces of the process with PID 1, which is the host’s init since we use --pid=host
    • "$(which bash)" finds the path of the host’s bash and runs it inside the namespaces (plain bash may not work on NixOS hosts)













  • NixOS has rm. But it’s not under /bin. There is no /bin in NixOS. The user’s programs are inside /run/current-system/sw/bin, and those are symlinks from files hidden in /nix/store.

    Running rm -rf / --no-preserve-root under NixOS, will not nuke the entire system, since /nix/store is mounted as read-only, and only remounted as rw when new applications are downloaded, or older unused ones are wiped.