[PATCH 2/5] host/rootfs: create a per-VM mount namespace

[Alyssa Ross <hi@alyssa.is>]

This will solve the problem of mounts for VMs being very annoying to
clean up, as evidenced in run-appimage.  It was looking to be even
worse for Flatpak.

Signed-off-by: Alyssa Ross <hi@alyssa.is>
---
 .../template/data/service/dbus/run            |  2 ++
 .../template/data/service/vhost-user-fs/run   |  4 +--
 .../image/usr/bin/create-vm-dependencies      | 23 ++++++++++++++---
 host/rootfs/image/usr/bin/run-appimage        | 25 +++++++++----------
 4 files changed, 34 insertions(+), 20 deletions(-)

diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run
index 351fc68..9b23192 100755
--- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run
+++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run
@@ -4,6 +4,8 @@
 
 importas -i VM VM
 
+nsenter --mount=${VM}/mount
+
 dbus-daemon
   --config-file /usr/share/dbus-1/session.conf
   --print-address 3
diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run
index 5d5ad7d..3848b0c 100755
--- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run
+++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run
@@ -12,8 +12,6 @@ export TMPDIR /run
 
 # The VM should not be able to write directly into a tmpfs, but there
 # can be writable block-based bind mounted subdirectories.
-unshare -m --propagation slave
 importas -i VM VM
-if { mount --rbind -o ro ${VM}/fs ${VM}/fs }
-
+nsenter --mount=${VM}/mount
 virtiofsd --fd 3 --shared-dir ${VM}/fs
diff --git a/host/rootfs/image/usr/bin/create-vm-dependencies b/host/rootfs/image/usr/bin/create-vm-dependencies
index f3a1b69..21681cd 100755
--- a/host/rootfs/image/usr/bin/create-vm-dependencies
+++ b/host/rootfs/image/usr/bin/create-vm-dependencies
@@ -1,11 +1,26 @@
 #!/bin/execlineb -S1
 # SPDX-License-Identifier: EUPL-1.2+
-# SPDX-FileCopyrightText: 2024 Alyssa Ross <hi@alyssa.is>
+# SPDX-FileCopyrightText: 2024-2025 Alyssa Ross <hi@alyssa.is>
 
-if { mount -m --rbind -o nofail /run/vm/by-id/${1}/config/fs /run/vm/by-id/${1}/fs/config }
+if { touch /run/vm/by-id/${1}/mount }
+if { mount --make-private --bind /run/vm/by-id/${1}/mount /run/vm/by-id/${1}/mount }
 
-if { mkdir -p /run/vm/by-id/${1}/doc-run/doc /run/vm/by-id/${1}/fs/doc }
-if { mount --rbind /run/vm/by-id/${1}/doc-run/doc /run/vm/by-id/${1}/fs/doc }
+if {
+  unshare --mount=/run/vm/by-id/${1}/mount
+
+  if {
+    mkdir -p
+      /run/vm/by-id/${1}/doc-run/doc
+      /run/vm/by-id/${1}/fs/config
+      /run/vm/by-id/${1}/fs/doc
+  }
+
+  if { mount --make-shared --rbind /run/vm/by-id/${1} /run/vm/by-id/${1} }
+
+  if { mount --rbind -o ro /run/vm/by-id/${1}/fs /run/vm/by-id/${1}/fs }
+  if { mount --rbind -o nofail /run/vm/by-id/${1}/config/fs /run/vm/by-id/${1}/fs/config }
+  mount --rbind /run/vm/by-id/${1}/doc-run/doc /run/vm/by-id/${1}/fs/doc
+}
 
 if { s6-instance-create /run/service/vm-services $1 }
 elglob -0 services /run/service/vm-services/instance/${1}/services/*
diff --git a/host/rootfs/image/usr/bin/run-appimage b/host/rootfs/image/usr/bin/run-appimage
index 6ccc61f..f2fe7bc 100755
--- a/host/rootfs/image/usr/bin/run-appimage
+++ b/host/rootfs/image/usr/bin/run-appimage
@@ -1,14 +1,12 @@
 #!/bin/execlineb -S1
 # SPDX-License-Identifier: EUPL-1.2+
-# SPDX-FileCopyrightText: 2024 Alyssa Ross <hi@alyssa.is>
+# SPDX-FileCopyrightText: 2024-2025 Alyssa Ross <hi@alyssa.is>
 
 backtick -E dir { mktemp -d /run/vm/by-id/XXXXXX }
 backtick -E id { basename -- $dir }
 
 if { mkdir -p /run/configs/${id}/fs }
-if { redirfd -w 1 /run/configs/${id}/fs/type echo appimage }
-if { touch /run/configs/${id}/fs/run }
-if { mount --rbind $1 /run/configs/${id}/fs/run }
+
 if {
   ln -s /usr/lib/spectrum/img/appvm/blk /usr/lib/spectrum/img/appvm/vmlinux
     /run/configs/${id}
@@ -18,6 +16,14 @@ if { ln -s /run/configs/${id} ${dir}/config }
 
 if { create-vm-dependencies $id }
 
+if {
+  nsenter --mount=${dir}/mount
+  cd ${dir}/fs/config
+  if { redirfd -w 1 type echo appimage }
+  if { touch run }
+  mount --bind $1 run
+}
+
 piperw 4 3
 background {
   fdclose 3
@@ -34,13 +40,6 @@ fdclose 3
 
 if { s6-instance-delete /run/service/vm-services $id }
 
-if {
-  forx -E mount {
-    /run/configs/${id}/fs/run
-    ${dir}/fs/config
-    ${dir}/fs/doc
-  }
-  umount $mount
-}
-
+if { umount ${dir}/mount } # mount namespace
+if { umount ${dir}/mount } # private bind mount
 rm -r $dir /run/configs/${id}
-- 
2.51.0