-
Notifications
You must be signed in to change notification settings - Fork 43
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Use mount namespace instead of chroot
This allow to not worry about mounts done within the namespace. We can now bind mount files into the sysroot instead of copying them.
- Loading branch information
1 parent
088d1b8
commit 4d57eb8
Showing
4 changed files
with
108 additions
and
20 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,105 @@ | ||
| #!/bin/bash | ||
|
|
||
| set -eu | ||
|
|
||
| # FIXME: This should be replace by a mount of devtmpfs when | ||
| # it is supported in user namespaces | ||
| bind_dev() { | ||
| dev="${1}/dev" | ||
|
|
||
| for device in null zero full random urandom tty; do | ||
| touch "${dev}/${device}" | ||
| mount --bind "/dev/${device}" "${dev}/${device}" | ||
| done | ||
| } | ||
|
|
||
| # Because systemd debian package post-install script is not very | ||
| # robust, we have to create a symlink and bind mount resolv.conf | ||
| # there. | ||
| bind_resolv() { | ||
| sysroot="${1}" | ||
|
|
||
| resolv_real_path="${sysroot}/run/fake-resolv.conf" | ||
| create_symlink=yes | ||
| if [ -L "${sysroot}/etc/resolv.conf" ]; then | ||
| resolv="$(readlink "${sysroot}/etc/resolv.conf")" | ||
| if [ "${resolv}" = "../run/systemd/resolve/stub-resolv.conf" ]; then | ||
| resolv_real_path="${sysroot}/run/systemd/resolve/stub-resolv.conf" | ||
| create_symlink=no | ||
| fi | ||
| fi | ||
| mkdir -p "$(dirname "${resolv_real_path}")" | ||
| touch "${resolv_real_path}" | ||
| mount --bind -o ro /etc/resolv.conf "${resolv_real_path}" | ||
| if [ "${create_symlink}" = yes ]; then | ||
| ln -srf "${resolv_real_path}" "${sysroot}/etc/resolv.conf" | ||
| fi | ||
| } | ||
|
|
||
| if [ $# -lt 3 ]; then | ||
| echo "Expected at least 3 arguments" 1>&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| command="${1}" | ||
| sysroot="${2}" | ||
| shift 2 | ||
|
|
||
| case "${command}" in | ||
| spawn) | ||
| cleanup() { | ||
| umount "${sysroot}/dev" || true | ||
| umount "${sysroot}/tmp" || true | ||
| umount "${sysroot}/run" || true | ||
| } | ||
| mount -t tmpfs -o mode=0755 tmpfs "${sysroot}/dev" | ||
| mount -t tmpfs -o mode=1777 tmpfs "${sysroot}/tmp" | ||
| mount -t tmpfs -o mode=0755 tmpfs "${sysroot}/run" | ||
| trap cleanup EXIT | ||
| unshare --pid --fork --mount -- "${0}" init "${sysroot}" "${@}" | ||
| ;; | ||
| init) | ||
| mount -t proc proc "${sysroot}/proc" | ||
| bind_dev "${sysroot}" | ||
| bind_resolv "${sysroot}" | ||
| while [ $# -gt 1 ]; do | ||
| case "${1}" in | ||
| --) | ||
| shift | ||
| break | ||
| ;; | ||
| --bind|--ro-bind) | ||
| if [ -d "$2" ]; then | ||
| if ! [ -d "${sysroot}/$3" ]; then | ||
| mkdir -p "${sysroot}/$3" | ||
| fi | ||
| else | ||
| if ! [ -e "${sysroot}/$3" ]; then | ||
| dir="$(dirname "${sysroot}/$3")" | ||
| if ! [ -d "${dir}" ]; then | ||
| mkdir -p "${dir}" | ||
| fi | ||
| touch "${sysroot}/$3" | ||
| fi | ||
| fi | ||
| extra_args=() | ||
| case "$1" in | ||
| --ro-bind) | ||
| extra_args=("-o" "ro") | ||
| ;; | ||
| esac | ||
| mount --bind "${extra_args[@]}" "$2" "${sysroot}/$3" | ||
| shift 3 | ||
| ;; | ||
| *) | ||
| break | ||
| ;; | ||
| esac | ||
| done | ||
| exec unshare --mount --root="${sysroot}" -- "${@}" | ||
| ;; | ||
| *) | ||
| echo "Unknown command" 1>&2 | ||
| exit 1 | ||
| ;; | ||
| esac |