Synnefo

Currently, the Image deployment process does host-based processing of Images.
In the future, these Images will be custom, user-provided files. This will have major security implications.
More specifically:

• The host mounts the target filesystem.
• The host traverses directories in the target filesystem using its kernel-based filesystem implementation
• The host runs image-provided binaries in chroot, essentially trusting the potentially user-provided image completely.

This ticket will track moving to an architecture where the image is completely untrusted:

• All accesses to the image should be done programmatically, e.g. using library-based filesystem implementations,
  from unprivileged processes, with direct access to the underlying block device.
• The host should never run any user-provided binaries in its own context, they can be run completely isolated, e.g. in a container (LXC) or VM context (libguestfs).