Rust 1.67

[J0WI]

No description provided.

[tianon]

I've tested this locally and it works 😄

Was it a draft just because it still doesn't quite get us to bookworm yet?

[tianon]

I'm going to bring this in for now because it is good and correct, even if it doesn't completely solve your goal -- I'll play with it a bit more post-merge and see if I can get it up to bookworm successfully. ❤️

[tianon]

I tried a bunch of combinations and no matter what I do, my Bookworm-based container is failing to run virtiofsd (and thus failing to run the VM / DD) 😭

The really weird thing is that it's failing with SIGSYS (bad system call). 🤔

[J0WI]

There are newer versions of virtiofsd available but I couldn't the sources of Docker Desktop to check what version it requires.

[tianon]

I think I could technically read the code, but I actually wrote this whole Dockerfile before I could've, and still try hard not to (especially so I don't accidentally cross a line here).

That being said, I do check the version before/after to ensure I package the same version they're using:

dockerfiles/docker-desktop/Dockerfile

Lines 99 to 103 in 8f420f3

	before="$(virtiofsd --version 2>&1)"; \
	dpkg-divert --add --rename --divert /opt/docker-desktop/bin/virtiofsd.orig /opt/docker-desktop/bin/virtiofsd; \
	ln -svfT virtiofsd.tianon /opt/docker-desktop/bin/virtiofsd; \
	after="$(virtiofsd --version 2>&1)"; \
	[ "$before" = "$after" ]; \

I think DD has code that will use a virtiofsd that comes with QEMU (which is why I added that bit which diverts that binary too slightly further down), but I don't know how far they go on compatibility, or even frankly what's going wrong to understand how/why/what might fix it. 😭

[tianon]

I just tried this again with the latest 4.29.0 and it's somehow worse now? 😭

Even with --security-opt seccomp=unconfined --security-opt apparmor=unconfined I'm getting EPERM just running com.docker.backend now: 😭

$ strace -ff com.docker.backend --with-frontend
execve("/opt/docker-desktop/bin/com.docker.backend", ["com.docker.backend", "--with-frontend"], 0x7fff649242c0 /* 13 vars */) = -1 EPERM (Operation not permitted)
strace: exec: Operation not permitted
+++ exited with 1 +++

[tianon]

Good news -- I don't know what fixed it, but it seems to be working now! 5edaaef