Demi Marie Obenour writes: > On 7/13/26 05:01, Alyssa Ross wrote: >> Demi Marie Obenour writes: >> >>> On 7/10/26 10:39, Alyssa Ross wrote: >>>> Demi Marie Obenour writes: >>>> >>>>> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run >>>>> index c3bfafe02ec6d2ee418fe56b033bbc4c7a73b186..f5c0f15184f0e72457f9c0bfa546590b9308eb9c 100755 >>>>> --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run >>>>> +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run >>>>> @@ -17,9 +17,10 @@ s6-applyuidgid -UzG 15 # wayland >>>>> s6-ipcserverd -1c 1 >>>>> >>>>> bwrap >>>>> - --unshare-all >>>>> - # --unshare-all only implies --unshare-user-try. >>>>> - # Make this more than a "try". >>>>> + --unshare-net >>>>> + --unshare-ipc >>>>> + --unshare-uts >>>>> + --unshare-cgroup >>>>> --unshare-user >>>>> --bind $WAYLAND_DISPLAY $WAYLAND_DISPLAY >>>>> --ro-bind /usr /usr >>>> >>>> There's a subtle behaviour change here. The pid namespace is reused >>>> between runs of crosvm, because if crosvm exits, s6-ipcserverd will stay >>>> running and wait for the next connection, then respawn crosvm. It's >>>> done this way because crosvm has made the unusual decision to support >>>> being started on a connected socket, rather than a listening socket like >>>> one might expect. Is that okay? I'd guess yes, but I want to check >>>> with you! >>> >>> It's less robust than I would like, but there is no reason one cannot >>> have both s6-supervise and bubblewrap create PID namespaces. That's >>> the approach I would go with. >> >> What's the point of the intermediate PID namespace? > > Ensure that there are no stale Cloud Hypervisor processes left behind. > Specifically, the PTY watcher ought to be moved to the main process > if there is only one PTY, but it’s currently a separate process. Huh? This is a discussion about the vhost-user-gpu service, which runs crosvm via s6-ipcserver. Cloud Hypervisor and PTY watchers are not involved.