Re: [PATCH] host/rootfs: Avoid using bwrap to enter new PID namespace

[Demi Marie Obenour <demiobenour@gmail.com>]

[-- Attachment #1.1: Type: text/plain, Size: 2555 bytes --]

On 7/15/26 06:15, Alyssa Ross wrote:
> Demi Marie Obenour <demiobenour@gmail.com> writes:
> 
>> On 7/13/26 05:01, Alyssa Ross wrote:
>>> Demi Marie Obenour <demiobenour@gmail.com> writes:
>>>
>>>> On 7/10/26 10:39, Alyssa Ross wrote:
>>>>> Demi Marie Obenour <demiobenour@gmail.com> writes:
>>>>>
>>>>>> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
>>>>>> index c3bfafe02ec6d2ee418fe56b033bbc4c7a73b186..f5c0f15184f0e72457f9c0bfa546590b9308eb9c 100755
>>>>>> --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
>>>>>> +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/vm-services/template/data/service/vhost-user-gpu/run
>>>>>> @@ -17,9 +17,10 @@ s6-applyuidgid -UzG 15 # wayland
>>>>>>  s6-ipcserverd -1c 1
>>>>>>  
>>>>>>  bwrap
>>>>>> -  --unshare-all
>>>>>> -  # --unshare-all only implies --unshare-user-try.
>>>>>> -  # Make this more than a "try".
>>>>>> +  --unshare-net
>>>>>> +  --unshare-ipc
>>>>>> +  --unshare-uts
>>>>>> +  --unshare-cgroup
>>>>>>    --unshare-user
>>>>>>    --bind $WAYLAND_DISPLAY $WAYLAND_DISPLAY
>>>>>>    --ro-bind /usr /usr
>>>>>
>>>>> There's a subtle behaviour change here.  The pid namespace is reused
>>>>> between runs of crosvm, because if crosvm exits, s6-ipcserverd will stay
>>>>> running and wait for the next connection, then respawn crosvm.  It's
>>>>> done this way because crosvm has made the unusual decision to support
>>>>> being started on a connected socket, rather than a listening socket like
>>>>> one might expect.  Is that okay?  I'd guess yes, but I want to check
>>>>> with you!
>>>>
>>>> It's less robust than I would like, but there is no reason one cannot
>>>> have both s6-supervise and bubblewrap create PID namespaces.  That's
>>>> the approach I would go with.
>>>
>>> What's the point of the intermediate PID namespace?
>>
>> Ensure that there are no stale Cloud Hypervisor processes left behind.
>> Specifically, the PTY watcher ought to be moved to the main process
>> if there is only one PTY, but it’s currently a separate process.
> 
> Huh?  This is a discussion about the vhost-user-gpu service, which runs
> crosvm via s6-ipcserver.  Cloud Hypervisor and PTY watchers are not
> involved.

Whoops, that was my mistake!
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]