Running WebSSH on Ubuntu inside an unprivileged container

[WilliamHorner]

Thank you for producing an excellent project. Ive been having all good experiences with it so far: you have clearly put a lot of thought into it and it is extremely well documented.

I am using Ubuntu inside unprivileged containers (of the LXC/Incus variety), so unfortunately docker is simply not an option. But LXC should be a perfectly adequate and at least as secure alternative to docker. So I have been following the deployment from source instructions. It was a bit of a learning curve, but I think I got there.

I have three artifacts now, that I would be happy to contribute if that is of interest? (In whatever form is best suited. They probably need a bit of work for general usage scenarios)

• A systemd service file that runs WebSSH as a service using a service account in the WebSSH Python virtual environment.
• An AppArmor profile for WebSSH, to further lock down the privileges. (I am not using some of the features so this profile may still be a little too tight for some people. Tbh, Im not sure how to run tests against this without the tests themselves influencing the profile)
• A .deb installer for Ubuntu 26.04 LTS that can run offline with no internet connection. Installs WebSSH and virtual environment, creates the Systemd service, adds the AppArmor profile and creates a service account. The deb file builds from a git clone so should be possible share the automation somehow. (And it certainly isnt as flexible in configuration as your main docker images)

[bifrost0x]

Hi William,

thank you so much for this, both for the kind words and for the work you've already put in. Running WebSSH in unprivileged LXC/Incus containers is a setup many homelab users share, and it's really valuable to hear how it went for you, including the rough edges of the source installation.

Some context first: I develop and maintain WebSSH on my own. To keep it secure and reliable, I focus my time on the product itself and only ship what I can build, test and verify again for every release. That's the only reason for the limits below. It isn't about your work, which I really appreciate.

Your systemd unit would help a lot of people, and I'd love to have it as an example in the source installation guide. A PR would be very welcome. Since it would be an example I recommend to everyone, it would be ideal if it:

• runs as a dedicated unprivileged user;
• uses NoNewPrivileges=yes, ProtectSystem=strict, PrivateTmp=yes and StateDirectory=;
• listens on 127.0.0.1 by default, behind a reverse proxy;
• keeps SECRET_KEY in a file only the service user can read (mode 0600);
• runs with a single worker, since WebSSH keeps SSH sessions in one process.

If parts of that don't fit your setup, just open the PR as it is and we'll shape it together.

The AppArmor profile and the .deb installer are where I have to be honest about my capacity. As a solo developer, I can't keep a second packaging pipeline or a profile that has to follow every feature up to date the way they'd deserve. And a profile that falls behind could break features silently, which is the last thing I'd want for users.

Both still sound genuinely useful for anyone in the same situation. If you'd like to publish them yourself, for example in your own repository, I'd be glad to link to them from the docs as a community resource. Your notes on the AppArmor profile, such as which features it currently restricts, would also make a great comment here for others to build on.

And you're warmly invited to contribute more broadly, now or whenever you like. WebSSH is open to anyone who wants to help shape it. If the project grows and a few people come together who are willing to look after a native packaging pipeline alongside me, the .deb and the AppArmor profile become a very realistic next step. I'd be happy to build that with you then.

Every bit of support like this means a lot to me. Thanks again for reaching out and for offering to contribute. Looking forward to your PR!