CLONE_NEWNS needs MS_PRIVATE on / before fork? about containers-from-scratch

[lizrice]

Hi @mlvnd, thanks for your very kind comments!

Yes, it does sound familiar. I have a note to myself somewhere about mounting root with the --make-rprivate flag so that mount points aren't shared. Sounds like setting the MS_PRIVATE flag is the better way of achieving this - thank you so much for letting me know about it!

[mlvnd]

Hi @lizrice,

You're welcome. I can submit a PR if you like. I got it working like this, but maybe there are other/better ways:

must(syscall.Mount("", "/", "", syscall.MS_PRIVATE|syscall.MS_REC, ""))
must(cmd.Run())

[lizrice]

That sounds good!

But now you have got me wondering whether it work to make a similar call to mount() with the private + recursive flags in the child, after the chroot? If that worked, it would only affect the part of the host file system that the container is using, which would be nice...

I haven't tried it, and I'd accept your PR as proposed - I'm just curious so if you happen to have time to try it out, let me know how it goes!

[mlvnd]

Hi @lizrice,

I tested your proposal and it works great! However, I spent some more time researching and noticed that this problem was marked as a bug in Go, which got fixed in 1.9 (see os/exec: handle Unshareflags with CLONE_NEWNS for more info). I'd guess you would agree this is an even nicer solution. :)

[mlvnd]

Thanks Liz!