Demi Marie Obenour writes: > On 7/10/26 10:39, Alyssa Ross wrote: >> Demi Marie Obenour writes: >> >>> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run >>> index c3bfafe02ec6d2ee418fe56b033bbc4c7a73b186..f5c0f15184f0e72457f9c0bfa546590b9308eb9c 100755 >>> --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run >>> +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run >>> @@ -17,9 +17,10 @@ s6-applyuidgid -UzG 15 # wayland >>> s6-ipcserverd -1c 1 >>> >>> bwrap >>> - --unshare-all >>> - # --unshare-all only implies --unshare-user-try. >>> - # Make this more than a "try". >>> + --unshare-net >>> + --unshare-ipc >>> + --unshare-uts >>> + --unshare-cgroup >>> --unshare-user >>> --bind $WAYLAND_DISPLAY $WAYLAND_DISPLAY >>> --ro-bind /usr /usr >> >> There's a subtle behaviour change here. The pid namespace is reused >> between runs of crosvm, because if crosvm exits, s6-ipcserverd will stay >> running and wait for the next connection, then respawn crosvm. It's >> done this way because crosvm has made the unusual decision to support >> being started on a connected socket, rather than a listening socket like >> one might expect. Is that okay? I'd guess yes, but I want to check >> with you! > > It's less robust than I would like, but there is no reason one cannot > have both s6-supervise and bubblewrap create PID namespaces. That's > the approach I would go with. What's the point of the intermediate PID namespace?