* [PATCH] host/rootfs: Avoid using bwrap to enter new PID namespace
@ 2026-07-09 23:46 Demi Marie Obenour
2026-07-10 14:39 ` Alyssa Ross
0 siblings, 1 reply; 7+ messages in thread
From: Demi Marie Obenour @ 2026-07-09 23:46 UTC (permalink / raw)
To: Spectrum OS Development; +Cc: Alyssa Ross, Demi Marie Obenour
s6-supervise can do so directly with less overhead.
Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
---
host/rootfs/file-list.mk | 2 ++
.../template/data/service/spectrum-router/flag-newpidns | 0
.../service/vm-services/template/data/service/spectrum-router/run | 5 ++++-
.../vm-services/template/data/service/vhost-user-gpu/flag-newpidns | 0
.../service/vm-services/template/data/service/vhost-user-gpu/run | 7 ++++---
5 files changed, 10 insertions(+), 4 deletions(-)
diff --git a/host/rootfs/file-list.mk b/host/rootfs/file-list.mk
index 3899d620717fc97f42e669e5313c4100dcf5b1cd..951cb2e9f0af05839ef5e9c0b5384c13e56622ff 100644
--- a/host/rootfs/file-list.mk
+++ b/host/rootfs/file-list.mk
@@ -30,10 +30,12 @@ FILES = \
image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd \
image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run \
image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/down \
+ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/flag-newpidns \
image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd \
image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run \
image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/notification-fd \
image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run \
+ image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/flag-newpidns \
image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/notification-fd \
image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run \
image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/xdg-desktop-portal-spectrum-host/notification-fd \
diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/flag-newpidns b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/flag-newpidns
new file mode 100644
index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391
diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run
index 3de58c27facc78c48176d8f9a6dd1827ac926f1a..ce84ed951de1a179d1430faae412fe4c1a2fb1f1 100755
--- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run
+++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run
@@ -25,7 +25,10 @@ if {
s6-setuidgid router
bwrap
- --unshare-all
+ --unshare-net
+ --unshare-ipc
+ --unshare-uts
+ --unshare-cgroup
--unshare-user
--dev-bind / /
--setenv RUST_LOG spectrum-router=debug,info
diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/flag-newpidns b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/flag-newpidns
new file mode 100644
index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391
diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
index c3bfafe02ec6d2ee418fe56b033bbc4c7a73b186..f5c0f15184f0e72457f9c0bfa546590b9308eb9c 100755
--- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
+++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
@@ -17,9 +17,10 @@ s6-applyuidgid -UzG 15 # wayland
s6-ipcserverd -1c 1
bwrap
- --unshare-all
- # --unshare-all only implies --unshare-user-try.
- # Make this more than a "try".
+ --unshare-net
+ --unshare-ipc
+ --unshare-uts
+ --unshare-cgroup
--unshare-user
--bind $WAYLAND_DISPLAY $WAYLAND_DISPLAY
--ro-bind /usr /usr
---
base-commit: 89f8c9238616b43e48b21e2eade41e061b006cd8
change-id: 20260709-s6-pid-namespaces-43b626d690cb
--
Sincerely,
Demi Marie Obenour (she/her/hers)
^ permalink raw reply related [flat|nested] 7+ messages in thread* Re: [PATCH] host/rootfs: Avoid using bwrap to enter new PID namespace
2026-07-09 23:46 [PATCH] host/rootfs: Avoid using bwrap to enter new PID namespace Demi Marie Obenour
@ 2026-07-10 14:39 ` Alyssa Ross
2026-07-10 17:09 ` Demi Marie Obenour
0 siblings, 1 reply; 7+ messages in thread
From: Alyssa Ross @ 2026-07-10 14:39 UTC (permalink / raw)
To: Demi Marie Obenour; +Cc: Spectrum OS Development
[-- Attachment #1: Type: text/plain, Size: 5235 bytes --]
Demi Marie Obenour <demiobenour@gmail.com> writes:
> s6-supervise can do so directly with less overhead.
>
> Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
> ---
> host/rootfs/file-list.mk | 2 ++
> .../template/data/service/spectrum-router/flag-newpidns | 0
> .../service/vm-services/template/data/service/spectrum-router/run | 5 ++++-
> .../vm-services/template/data/service/vhost-user-gpu/flag-newpidns | 0
> .../service/vm-services/template/data/service/vhost-user-gpu/run | 7 ++++---
> 5 files changed, 10 insertions(+), 4 deletions(-)
I guess this isn't done for run-vmm because it might not be run through s6?
> diff --git a/host/rootfs/file-list.mk b/host/rootfs/file-list.mk
> index 3899d620717fc97f42e669e5313c4100dcf5b1cd..951cb2e9f0af05839ef5e9c0b5384c13e56622ff 100644
> --- a/host/rootfs/file-list.mk
> +++ b/host/rootfs/file-list.mk
> @@ -30,10 +30,12 @@ FILES = \
> image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd \
> image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run \
> image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/down \
> + image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/flag-newpidns \
> image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd \
> image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run \
> image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/notification-fd \
> image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run \
> + image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/flag-newpidns \
> image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/notification-fd \
> image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run \
> image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/xdg-desktop-portal-spectrum-host/notification-fd \
> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/flag-newpidns b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/flag-newpidns
> new file mode 100644
> index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391
> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run
> index 3de58c27facc78c48176d8f9a6dd1827ac926f1a..ce84ed951de1a179d1430faae412fe4c1a2fb1f1 100755
> --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run
> +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run
> @@ -25,7 +25,10 @@ if {
> s6-setuidgid router
>
> bwrap
> - --unshare-all
> + --unshare-net
> + --unshare-ipc
> + --unshare-uts
> + --unshare-cgroup
> --unshare-user
> --dev-bind / /
> --setenv RUST_LOG spectrum-router=debug,info
> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/flag-newpidns b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/flag-newpidns
> new file mode 100644
> index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391
> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
> index c3bfafe02ec6d2ee418fe56b033bbc4c7a73b186..f5c0f15184f0e72457f9c0bfa546590b9308eb9c 100755
> --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
> +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
> @@ -17,9 +17,10 @@ s6-applyuidgid -UzG 15 # wayland
> s6-ipcserverd -1c 1
>
> bwrap
> - --unshare-all
> - # --unshare-all only implies --unshare-user-try.
> - # Make this more than a "try".
> + --unshare-net
> + --unshare-ipc
> + --unshare-uts
> + --unshare-cgroup
> --unshare-user
> --bind $WAYLAND_DISPLAY $WAYLAND_DISPLAY
> --ro-bind /usr /usr
There's a subtle behaviour change here. The pid namespace is reused
between runs of crosvm, because if crosvm exits, s6-ipcserverd will stay
running and wait for the next connection, then respawn crosvm. It's
done this way because crosvm has made the unusual decision to support
being started on a connected socket, rather than a listening socket like
one might expect. Is that okay? I'd guess yes, but I want to check
with you!
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH] host/rootfs: Avoid using bwrap to enter new PID namespace
2026-07-10 14:39 ` Alyssa Ross
@ 2026-07-10 17:09 ` Demi Marie Obenour
2026-07-13 9:01 ` Alyssa Ross
0 siblings, 1 reply; 7+ messages in thread
From: Demi Marie Obenour @ 2026-07-10 17:09 UTC (permalink / raw)
To: Alyssa Ross; +Cc: Spectrum OS Development
[-- Attachment #1.1: Type: text/plain, Size: 5602 bytes --]
On 7/10/26 10:39, Alyssa Ross wrote:
> Demi Marie Obenour <demiobenour@gmail.com> writes:
>
>> s6-supervise can do so directly with less overhead.
>>
>> Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
>> ---
>> host/rootfs/file-list.mk | 2 ++
>> .../template/data/service/spectrum-router/flag-newpidns | 0
>> .../service/vm-services/template/data/service/spectrum-router/run | 5 ++++-
>> .../vm-services/template/data/service/vhost-user-gpu/flag-newpidns | 0
>> .../service/vm-services/template/data/service/vhost-user-gpu/run | 7 ++++---
>> 5 files changed, 10 insertions(+), 4 deletions(-)
>
> I guess this isn't done for run-vmm because it might not be run through s6?
Exactly!
>> diff --git a/host/rootfs/file-list.mk b/host/rootfs/file-list.mk
>> index 3899d620717fc97f42e669e5313c4100dcf5b1cd..951cb2e9f0af05839ef5e9c0b5384c13e56622ff 100644
>> --- a/host/rootfs/file-list.mk
>> +++ b/host/rootfs/file-list.mk
>> @@ -30,10 +30,12 @@ FILES = \
>> image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/notification-fd \
>> image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/dbus/run \
>> image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/down \
>> + image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/flag-newpidns \
>> image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/notification-fd \
>> image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run \
>> image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/notification-fd \
>> image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-fs/run \
>> + image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/flag-newpidns \
>> image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/notification-fd \
>> image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run \
>> image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/xdg-desktop-portal-spectrum-host/notification-fd \
>> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/flag-newpidns b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/flag-newpidns
>> new file mode 100644
>> index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391
>> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run
>> index 3de58c27facc78c48176d8f9a6dd1827ac926f1a..ce84ed951de1a179d1430faae412fe4c1a2fb1f1 100755
>> --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run
>> +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/spectrum-router/run
>> @@ -25,7 +25,10 @@ if {
>> s6-setuidgid router
>>
>> bwrap
>> - --unshare-all
>> + --unshare-net
>> + --unshare-ipc
>> + --unshare-uts
>> + --unshare-cgroup
>> --unshare-user
>> --dev-bind / /
>> --setenv RUST_LOG spectrum-router=debug,info
>> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/flag-newpidns b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/flag-newpidns
>> new file mode 100644
>> index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391
>> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
>> index c3bfafe02ec6d2ee418fe56b033bbc4c7a73b186..f5c0f15184f0e72457f9c0bfa546590b9308eb9c 100755
>> --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
>> +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
>> @@ -17,9 +17,10 @@ s6-applyuidgid -UzG 15 # wayland
>> s6-ipcserverd -1c 1
>>
>> bwrap
>> - --unshare-all
>> - # --unshare-all only implies --unshare-user-try.
>> - # Make this more than a "try".
>> + --unshare-net
>> + --unshare-ipc
>> + --unshare-uts
>> + --unshare-cgroup
>> --unshare-user
>> --bind $WAYLAND_DISPLAY $WAYLAND_DISPLAY
>> --ro-bind /usr /usr
>
> There's a subtle behaviour change here. The pid namespace is reused
> between runs of crosvm, because if crosvm exits, s6-ipcserverd will stay
> running and wait for the next connection, then respawn crosvm. It's
> done this way because crosvm has made the unusual decision to support
> being started on a connected socket, rather than a listening socket like
> one might expect. Is that okay? I'd guess yes, but I want to check
> with you!
It's less robust than I would like, but there is no reason one cannot
have both s6-supervise and bubblewrap create PID namespaces. That's
the approach I would go with.
--
Sincerely,
Demi Marie Obenour (she/her/hers)
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH] host/rootfs: Avoid using bwrap to enter new PID namespace
2026-07-10 17:09 ` Demi Marie Obenour
@ 2026-07-13 9:01 ` Alyssa Ross
2026-07-13 14:17 ` Demi Marie Obenour
0 siblings, 1 reply; 7+ messages in thread
From: Alyssa Ross @ 2026-07-13 9:01 UTC (permalink / raw)
To: Demi Marie Obenour; +Cc: Spectrum OS Development
[-- Attachment #1: Type: text/plain, Size: 1838 bytes --]
Demi Marie Obenour <demiobenour@gmail.com> writes:
> On 7/10/26 10:39, Alyssa Ross wrote:
>> Demi Marie Obenour <demiobenour@gmail.com> writes:
>>
>>> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
>>> index c3bfafe02ec6d2ee418fe56b033bbc4c7a73b186..f5c0f15184f0e72457f9c0bfa546590b9308eb9c 100755
>>> --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
>>> +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
>>> @@ -17,9 +17,10 @@ s6-applyuidgid -UzG 15 # wayland
>>> s6-ipcserverd -1c 1
>>>
>>> bwrap
>>> - --unshare-all
>>> - # --unshare-all only implies --unshare-user-try.
>>> - # Make this more than a "try".
>>> + --unshare-net
>>> + --unshare-ipc
>>> + --unshare-uts
>>> + --unshare-cgroup
>>> --unshare-user
>>> --bind $WAYLAND_DISPLAY $WAYLAND_DISPLAY
>>> --ro-bind /usr /usr
>>
>> There's a subtle behaviour change here. The pid namespace is reused
>> between runs of crosvm, because if crosvm exits, s6-ipcserverd will stay
>> running and wait for the next connection, then respawn crosvm. It's
>> done this way because crosvm has made the unusual decision to support
>> being started on a connected socket, rather than a listening socket like
>> one might expect. Is that okay? I'd guess yes, but I want to check
>> with you!
>
> It's less robust than I would like, but there is no reason one cannot
> have both s6-supervise and bubblewrap create PID namespaces. That's
> the approach I would go with.
What's the point of the intermediate PID namespace?
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] host/rootfs: Avoid using bwrap to enter new PID namespace
2026-07-13 9:01 ` Alyssa Ross
@ 2026-07-13 14:17 ` Demi Marie Obenour
2026-07-15 10:15 ` Alyssa Ross
0 siblings, 1 reply; 7+ messages in thread
From: Demi Marie Obenour @ 2026-07-13 14:17 UTC (permalink / raw)
To: Alyssa Ross; +Cc: Spectrum OS Development
[-- Attachment #1.1: Type: text/plain, Size: 2178 bytes --]
On 7/13/26 05:01, Alyssa Ross wrote:
> Demi Marie Obenour <demiobenour@gmail.com> writes:
>
>> On 7/10/26 10:39, Alyssa Ross wrote:
>>> Demi Marie Obenour <demiobenour@gmail.com> writes:
>>>
>>>> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
>>>> index c3bfafe02ec6d2ee418fe56b033bbc4c7a73b186..f5c0f15184f0e72457f9c0bfa546590b9308eb9c 100755
>>>> --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
>>>> +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
>>>> @@ -17,9 +17,10 @@ s6-applyuidgid -UzG 15 # wayland
>>>> s6-ipcserverd -1c 1
>>>>
>>>> bwrap
>>>> - --unshare-all
>>>> - # --unshare-all only implies --unshare-user-try.
>>>> - # Make this more than a "try".
>>>> + --unshare-net
>>>> + --unshare-ipc
>>>> + --unshare-uts
>>>> + --unshare-cgroup
>>>> --unshare-user
>>>> --bind $WAYLAND_DISPLAY $WAYLAND_DISPLAY
>>>> --ro-bind /usr /usr
>>>
>>> There's a subtle behaviour change here. The pid namespace is reused
>>> between runs of crosvm, because if crosvm exits, s6-ipcserverd will stay
>>> running and wait for the next connection, then respawn crosvm. It's
>>> done this way because crosvm has made the unusual decision to support
>>> being started on a connected socket, rather than a listening socket like
>>> one might expect. Is that okay? I'd guess yes, but I want to check
>>> with you!
>>
>> It's less robust than I would like, but there is no reason one cannot
>> have both s6-supervise and bubblewrap create PID namespaces. That's
>> the approach I would go with.
>
> What's the point of the intermediate PID namespace?
Ensure that there are no stale Cloud Hypervisor processes left behind.
Specifically, the PTY watcher ought to be moved to the main process
if there is only one PTY, but it’s currently a separate process.
--
Sincerely,
Demi Marie Obenour (she/her/hers)
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] host/rootfs: Avoid using bwrap to enter new PID namespace
2026-07-13 14:17 ` Demi Marie Obenour
@ 2026-07-15 10:15 ` Alyssa Ross
2026-07-15 16:51 ` Demi Marie Obenour
0 siblings, 1 reply; 7+ messages in thread
From: Alyssa Ross @ 2026-07-15 10:15 UTC (permalink / raw)
To: Demi Marie Obenour; +Cc: Spectrum OS Development
[-- Attachment #1: Type: text/plain, Size: 2381 bytes --]
Demi Marie Obenour <demiobenour@gmail.com> writes:
> On 7/13/26 05:01, Alyssa Ross wrote:
>> Demi Marie Obenour <demiobenour@gmail.com> writes:
>>
>>> On 7/10/26 10:39, Alyssa Ross wrote:
>>>> Demi Marie Obenour <demiobenour@gmail.com> writes:
>>>>
>>>>> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
>>>>> index c3bfafe02ec6d2ee418fe56b033bbc4c7a73b186..f5c0f15184f0e72457f9c0bfa546590b9308eb9c 100755
>>>>> --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
>>>>> +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
>>>>> @@ -17,9 +17,10 @@ s6-applyuidgid -UzG 15 # wayland
>>>>> s6-ipcserverd -1c 1
>>>>>
>>>>> bwrap
>>>>> - --unshare-all
>>>>> - # --unshare-all only implies --unshare-user-try.
>>>>> - # Make this more than a "try".
>>>>> + --unshare-net
>>>>> + --unshare-ipc
>>>>> + --unshare-uts
>>>>> + --unshare-cgroup
>>>>> --unshare-user
>>>>> --bind $WAYLAND_DISPLAY $WAYLAND_DISPLAY
>>>>> --ro-bind /usr /usr
>>>>
>>>> There's a subtle behaviour change here. The pid namespace is reused
>>>> between runs of crosvm, because if crosvm exits, s6-ipcserverd will stay
>>>> running and wait for the next connection, then respawn crosvm. It's
>>>> done this way because crosvm has made the unusual decision to support
>>>> being started on a connected socket, rather than a listening socket like
>>>> one might expect. Is that okay? I'd guess yes, but I want to check
>>>> with you!
>>>
>>> It's less robust than I would like, but there is no reason one cannot
>>> have both s6-supervise and bubblewrap create PID namespaces. That's
>>> the approach I would go with.
>>
>> What's the point of the intermediate PID namespace?
>
> Ensure that there are no stale Cloud Hypervisor processes left behind.
> Specifically, the PTY watcher ought to be moved to the main process
> if there is only one PTY, but it’s currently a separate process.
Huh? This is a discussion about the vhost-user-gpu service, which runs
crosvm via s6-ipcserver. Cloud Hypervisor and PTY watchers are not
involved.
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] host/rootfs: Avoid using bwrap to enter new PID namespace
2026-07-15 10:15 ` Alyssa Ross
@ 2026-07-15 16:51 ` Demi Marie Obenour
0 siblings, 0 replies; 7+ messages in thread
From: Demi Marie Obenour @ 2026-07-15 16:51 UTC (permalink / raw)
To: Alyssa Ross; +Cc: Spectrum OS Development
[-- Attachment #1.1: Type: text/plain, Size: 2555 bytes --]
On 7/15/26 06:15, Alyssa Ross wrote:
> Demi Marie Obenour <demiobenour@gmail.com> writes:
>
>> On 7/13/26 05:01, Alyssa Ross wrote:
>>> Demi Marie Obenour <demiobenour@gmail.com> writes:
>>>
>>>> On 7/10/26 10:39, Alyssa Ross wrote:
>>>>> Demi Marie Obenour <demiobenour@gmail.com> writes:
>>>>>
>>>>>> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
>>>>>> index c3bfafe02ec6d2ee418fe56b033bbc4c7a73b186..f5c0f15184f0e72457f9c0bfa546590b9308eb9c 100755
>>>>>> --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
>>>>>> +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
>>>>>> @@ -17,9 +17,10 @@ s6-applyuidgid -UzG 15 # wayland
>>>>>> s6-ipcserverd -1c 1
>>>>>>
>>>>>> bwrap
>>>>>> - --unshare-all
>>>>>> - # --unshare-all only implies --unshare-user-try.
>>>>>> - # Make this more than a "try".
>>>>>> + --unshare-net
>>>>>> + --unshare-ipc
>>>>>> + --unshare-uts
>>>>>> + --unshare-cgroup
>>>>>> --unshare-user
>>>>>> --bind $WAYLAND_DISPLAY $WAYLAND_DISPLAY
>>>>>> --ro-bind /usr /usr
>>>>>
>>>>> There's a subtle behaviour change here. The pid namespace is reused
>>>>> between runs of crosvm, because if crosvm exits, s6-ipcserverd will stay
>>>>> running and wait for the next connection, then respawn crosvm. It's
>>>>> done this way because crosvm has made the unusual decision to support
>>>>> being started on a connected socket, rather than a listening socket like
>>>>> one might expect. Is that okay? I'd guess yes, but I want to check
>>>>> with you!
>>>>
>>>> It's less robust than I would like, but there is no reason one cannot
>>>> have both s6-supervise and bubblewrap create PID namespaces. That's
>>>> the approach I would go with.
>>>
>>> What's the point of the intermediate PID namespace?
>>
>> Ensure that there are no stale Cloud Hypervisor processes left behind.
>> Specifically, the PTY watcher ought to be moved to the main process
>> if there is only one PTY, but it’s currently a separate process.
>
> Huh? This is a discussion about the vhost-user-gpu service, which runs
> crosvm via s6-ipcserver. Cloud Hypervisor and PTY watchers are not
> involved.
Whoops, that was my mistake!
--
Sincerely,
Demi Marie Obenour (she/her/hers)
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2026-07-15 16:51 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-09 23:46 [PATCH] host/rootfs: Avoid using bwrap to enter new PID namespace Demi Marie Obenour
2026-07-10 14:39 ` Alyssa Ross
2026-07-10 17:09 ` Demi Marie Obenour
2026-07-13 9:01 ` Alyssa Ross
2026-07-13 14:17 ` Demi Marie Obenour
2026-07-15 10:15 ` Alyssa Ross
2026-07-15 16:51 ` Demi Marie Obenour
Code repositories for project(s) associated with this public inbox
https://spectrum-os.org/git/doc
https://spectrum-os.org/git/mktuntap
https://spectrum-os.org/git/spectrum
https://spectrum-os.org/git/ucspi-vsock
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).