Re: [PATCH 2/5] host/rootfs: create a per-VM mount namespace

[Demi Marie Obenour <demiobenour@gmail.com>]

[-- Attachment #1.1.1: Type: text/plain, Size: 5789 bytes --]

On 11/30/25 23:45, Alyssa Ross wrote:
> This will solve the problem of mounts for VMs being very annoying to
> clean up, as evidenced in run-appimage.  It was looking to be even
> worse for Flatpak.

Does the updater also need to be adjusted?

> Signed-off-by: Alyssa Ross <hi@alyssa.is>
> ---
>  .../template/data/service/dbus/run            |  2 ++
>  .../template/data/service/vhost-user-fs/run   |  4 +--
>  .../image/usr/bin/create-vm-dependencies      | 23 ++++++++++++++---
>  host/rootfs/image/usr/bin/run-appimage        | 25 +++++++++----------
>  4 files changed, 34 insertions(+), 20 deletions(-)
> 
> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run
> index 351fc68..9b23192 100755
> --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run
> +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run
> @@ -4,6 +4,8 @@
>  
>  importas -i VM VM
>  
> +nsenter --mount=${VM}/mount
> +
>  dbus-daemon
>    --config-file /usr/share/dbus-1/session.conf
>    --print-address 3
> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run
> index 5d5ad7d..3848b0c 100755
> --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run
> +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run
> @@ -12,8 +12,6 @@ export TMPDIR /run
>  
>  # The VM should not be able to write directly into a tmpfs, but there
>  # can be writable block-based bind mounted subdirectories.

Comment should be moved to the code that does the bind mount.  Also,
this comment is somewhat stale: the main reason to prevent writing
into the toplevel fs/ folder is that host tools (like the updater)
assume symlinks can't be created in it.

> -unshare -m --propagation slave
>  importas -i VM VM
> -if { mount --rbind -o ro ${VM}/fs ${VM}/fs }
> -
> +nsenter --mount=${VM}/mount
>  virtiofsd --fd 3 --shared-dir ${VM}/fs
> diff --git a/host/rootfs/image/usr/bin/create-vm-dependencies b/host/rootfs/image/usr/bin/create-vm-dependencies
> index f3a1b69..21681cd 100755
> --- a/host/rootfs/image/usr/bin/create-vm-dependencies
> +++ b/host/rootfs/image/usr/bin/create-vm-dependencies
> @@ -1,11 +1,26 @@
>  #!/bin/execlineb -S1
>  # SPDX-License-Identifier: EUPL-1.2+
> -# SPDX-FileCopyrightText: 2024 Alyssa Ross <hi@alyssa.is>
> +# SPDX-FileCopyrightText: 2024-2025 Alyssa Ross <hi@alyssa.is>
>  
> -if { mount -m --rbind -o nofail /run/vm/by-id/${1}/config/fs /run/vm/by-id/${1}/fs/config }
> +if { touch /run/vm/by-id/${1}/mount }
> +if { mount --make-private --bind /run/vm/by-id/${1}/mount /run/vm/by-id/${1}/mount }
>  
> -if { mkdir -p /run/vm/by-id/${1}/doc-run/doc /run/vm/by-id/${1}/fs/doc }
> -if { mount --rbind /run/vm/by-id/${1}/doc-run/doc /run/vm/by-id/${1}/fs/doc }
> +if {
> +  unshare --mount=/run/vm/by-id/${1}/mount
> +
> +  if {
> +    mkdir -p
> +      /run/vm/by-id/${1}/doc-run/doc
> +      /run/vm/by-id/${1}/fs/config
> +      /run/vm/by-id/${1}/fs/doc
I would also create /run/vm/by-id/${1}/config/fs...

> +  }
> +
> +  if { mount --make-shared --rbind /run/vm/by-id/${1} /run/vm/by-id/${1} }
> +
> +  if { mount --rbind -o ro /run/vm/by-id/${1}/fs /run/vm/by-id/${1}/fs }

VMs should not be able to write to their own config, so this and the
next like should be swapped.

> +  if { mount --rbind -o nofail /run/vm/by-id/${1}/config/fs /run/vm/by-id/${1}/fs/config }

...and remove this `-o nofail`.

> +  mount --rbind /run/vm/by-id/${1}/doc-run/doc /run/vm/by-id/${1}/fs/doc
> +}
> >  if { s6-instance-create /run/service/vm-services $1 }
>  elglob -0 services /run/service/vm-services/instance/${1}/services/*
> diff --git a/host/rootfs/image/usr/bin/run-appimage b/host/rootfs/image/usr/bin/run-appimage
> index 6ccc61f..f2fe7bc 100755
> --- a/host/rootfs/image/usr/bin/run-appimage
> +++ b/host/rootfs/image/usr/bin/run-appimage
> @@ -1,14 +1,12 @@
>  #!/bin/execlineb -S1
>  # SPDX-License-Identifier: EUPL-1.2+
> -# SPDX-FileCopyrightText: 2024 Alyssa Ross <hi@alyssa.is>
> +# SPDX-FileCopyrightText: 2024-2025 Alyssa Ross <hi@alyssa.is>
>  
>  backtick -E dir { mktemp -d /run/vm/by-id/XXXXXX }
>  backtick -E id { basename -- $dir }
>  
>  if { mkdir -p /run/configs/${id}/fs }
> -if { redirfd -w 1 /run/configs/${id}/fs/type echo appimage }
> -if { touch /run/configs/${id}/fs/run }
> -if { mount --rbind $1 /run/configs/${id}/fs/run }
> +
>  if {
>    ln -s /usr/lib/spectrum/img/appvm/blk /usr/lib/spectrum/img/appvm/vmlinux
>      /run/configs/${id}
> @@ -18,6 +16,14 @@ if { ln -s /run/configs/${id} ${dir}/config }
>  
>  if { create-vm-dependencies $id }
>  
> +if {
> +  nsenter --mount=${dir}/mount
> +  cd ${dir}/fs/config
> +  if { redirfd -w 1 type echo appimage }
> +  if { touch run }
> +  mount --bind $1 run
> +}
> +
>  piperw 4 3
>  background {
>    fdclose 3
> @@ -34,13 +40,6 @@ fdclose 3
>  
>  if { s6-instance-delete /run/service/vm-services $id }
>  
> -if {
> -  forx -E mount {
> -    /run/configs/${id}/fs/run
> -    ${dir}/fs/config
> -    ${dir}/fs/doc
> -  }
> -  umount $mount
> -}
> -
> +if { umount ${dir}/mount } # mount namespace
> +if { umount ${dir}/mount } # private bind mount
>  rm -r $dir /run/configs/${id}


-- 
Sincerely,
Demi Marie Obenour (she/her/hers)

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 7253 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]