Installing mediabrowser in a jail root
I have been playing around with media browser lately. Media browser is a streaming server, like plex. For me it has the advantage that I can host the website and security at home. That way I can easily stream over https and control user authentication myself. For security reasons I installed it in a jail root using schroot on my debian box. This is how I did it.
Preparing your host
First make sure you have a working installation of schroot on your box (using sudo here to show which steps should be executed as root):
sudo apt-get install schroot debootstrap
Then make the directory for your jail and install a base system:
sudo mkdir -p /srv/chroot/mediabrowser
sudo debootstrap jessie /srv/chroot/mediabrowser http://ftp.de.debian.org/debian
Please note that you will need to install jessie to get the right mono versions for your installation. If you don’t install jessie, you need to manually install the latest mono packages for debian. Please also note that I install from the local German debian repository. You can change to your local one if needed.
You need to create a user for your installation. The idea is that this user is known with the same ID in both your host and your jail (the guest system). This will make it easier to give the user access to system wide resources.
sudo adduser --system --shell /bin/false --disabled-password --no-create-home mediabrowser
The system will output something like this:
Adding system user `mediabrowser’ (UID 122) …
You should remember the UID (you can later check the /etc/passwd file as well, if you know how to do that).
Make sure schroot knows your environment. We need to create / change some config files. First Now, as root, create the file /etc/schroot/chroot.d/mediabrowser and give it the following content:
[mediabrowser] aliases=mb directory=/srv/chroot/mediabrowser type=directory description=Chroot for the media browser service users=mediabrowser groups=root root-groups=root profile=mediabrowser personality=linux preserve-environment=true
This will make sure schroot knows about your jail. Schroot also needs to know how it should configure your jail. For that create the following directory:
sudo mkdir -p /etc/schroot/mediabrowser
In it you need to create three files (as root): copyfiles and fstab. The contents of /etc/schroot/mediabrowser/copyfiles should be:
# Files to copy into the chroot from the host system. # # <source and destination> /etc/resolv.conf
The contents of /etc/schroot/mediabrowser/fstab should be as follows. Please note that I assume that you have your content locally on the host you are installing your jail. If your content is on a remote (samba or nfs) host, you need to add the right commands to mount those remote filesystems.
# fstab: static file system information for chroots. # Note that the mount point will be prefixed by the chroot path # (CHROOT_PATH) # # <file system> <mount point> <type> <options> <dump> <pass> /proc /proc none rw,bind 0 0 /sys /sys none rw,bind 0 0 /dev /dev none rw,bind 0 0 /dev/pts /dev/pts none rw,bind 0 0 #/home /home none rw,bind 0 0 /tmp /tmp none rw,bind 0 0 # Add mounts to your content files here, what follows is an example /path/to/content/on/your/host /path/on/your/guest/to/mount/that/content none rw,bind 0 0
Note: you can also specify an nssdatabases file in this directory. I personally don’t want to copy any configuration files from my host to my guest, so I don’t use it. See the schroot documentation to make use of this feature.