Skip to content


Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
rootless chroot jails inside dynos
Perl Shell
branch: master

This branch is 5 commits ahead, 5 commits behind fabiokung:master

Fetching latest commit…

Cannot retrieve the latest commit at this time

Failed to load latest commit information.

(fake) su

Heroku buildpack that creates a chroot jail, and allows users to run commands as (fake)root inside it.


$ ls
Gemfile      Gemfile.lock web.rb

$ heroku create -s cedar -b

$ git push heroku master

$ heroku run bash

(dyno)$ id
uid=28171(u28171) gid=28171

(dyno)$ fakesu

(dyno)# id
uid=0(root) gid=0(root)

(dyno)# whoami

(dyno)# ls ~
Gemfile  Gemfile.lock  bin  web.rb

Default process type (console)

$ heroku run console

(dyno)# whoami

-c option for custom commands as (fake)root

$ heroku run bash

(dyno)$ fakesu -c id
uid=0(root) gid=0(root)

(dyno)$ fakesu -c touch /etc/file-created-as-root

(dyno)$ fakesu -c ls -l /etc/file-created-as-root
-rw------- 1 root root 0 Jan 30 09:50 /etc/file-created-as-root

Why would I need such a crazy thing?

Because I want to build and run my own system packages

e.g.: a different version of ruby:

$ heroku run console

(dyno)# cd /tmp

(dyno)# curl -O

(dyno)# tar zxvf ruby-1.9.2-pXXX.tar.gz

(dyno)# cd ruby-1.9.2-pXXX

(dyno)# ./configure --prefix=/usr/local optflags="-O3" debugflags="-g3 -ggdb"

(dyno)# make

(dyno)# make install

Because I have system dependencies (e.g. libzmq-dev)

$ heroku run console

(dyno)# cat Gemfile
source :rubygems
gem "zmq"

(dyno)# echo "deb lucid main" >> /etc/apt/sources.list

(dyno)# echo "deb lucid main" >> /etc/apt/sources.list

(dyno)# apt-get update

(dyno)# apt-get install libzmq-dbg libzmq-dev libzmq1

(dyno)# bundle install
Fetching source index for
Installing zmq (2.1.4) with native extensions 
Using bundler (1.0.21) 

In this case, your application processes (Procfile) would need to be started inside the chroot jail, where the system dependencies were installed.

fakesu -c can be used for that, e.g.: fakesu -c bundle exec thin -p $PORT ...

Because I want to install and run services

$ heroku run console

(dyno)# apt-get install nginx

(dyno)# env | grep PORT

(dyno)# vim /etc/nginx/sites-available/default
edit the "listen 80" line and change it to the port given by the previous command

(dyno)# /etc/init.d/nginx restart

Using another terminal, it is now possible to create routes:

$ heroku ps
Process  State      Command  
-------  ---------  -------  
run.1    up for 1m  bash    

$ heroku routes:create
Creating route... done

$ heroku routes:attach tcp:// run.1

$ open

Because it can be combined with other buildpacks

TODO, using the heroku-multi-buildpack

Because I want to be the (fake)root of my dyno :)

Something went wrong with that request. Please try again.