Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Revert "mount: allow bind-mounting a file to a file" #225

Merged
merged 2 commits into from
Jul 29, 2023

Conversation

rminnich
Copy link
Member

This reverts commit 3993009.

That commit would create directories and files as needed, following the original which would create directories as needed.

Both this commit and the original, with MkdirAll, were a mistake, because different users, at different times, could conflict.

E.g., a ubuntu container might have a directory named /etc/ssh/x, and an alpine container might have a file named /etc/ssh/x, and in each case, with this code, one would modify the local root in a way which would break the other one. Since we now routinely run different docker images on the same node at the same time, this modification, and the original code, are unacceptable.

Should you need a file named, e.g., /etc/resolv.conf, that you can bind over, there are a few options:
o modify the initramfs to include /etc/resolv.conf, and bind over that o append a cpio with the desired contents of the initramfs to
use on boot
o run a cpu command which sets up the desired directory structure.
Recall that one can omit /etc from the namespace of a cpu
command, allowing one to modify the node's /etc; or, /etc
should be visible in /tmp/local/etc.

I.e., /tmp/cpu/local has the local file system; or, you can have a simple statically linked program which does the work, and run a cpu with a minimal namespace to set that up.

It's a shame that this is so complex, but it goes back to Linux's not very good design for private namespaces. Linux private name spaces are bit of a hack on top of mount, whereas Plan 9's namespaces are implemented via a namespace walking mechanism in the kernel.

This reverts commit 3993009.

That commit would create directories and files as needed, following
the original which would create directories as needed.

Both this commit and the original, with MkdirAll, were a mistake,
because different users, at different times, could conflict.

E.g., a ubuntu container might have a directory named /etc/ssh/x,
and an alpine container might have a file named /etc/ssh/x, and
in each case, with this code, one would modify the local root
in a way which would break the other one. Since we now routinely
run different docker images on the same node at the same time,
this modification, and the original code, are unacceptable.

Should you need a file named, e.g., /etc/resolv.conf, that you can
bind over, there are a few options:
o modify the initramfs to include /etc/resolv.conf, and bind over that
o append a cpio with the desired contents of the initramfs to
  use on boot
o run a cpu command which sets up the desired directory structure.
  Recall that one can omit /etc from the namespace of a cpu
  command, allowing one to modify the node's /etc; or, /etc
  should be visible in /tmp/local/etc.

I.e., /tmp/cpu/local has the local file system; or, you can have
a simple statically linked program which does the work, and run
a cpu with a minimal namespace to set that up.

It's a shame that this is so complex, but it goes back to Linux's
not very good design for private namespaces. Linux private name
spaces are bit of a hack on top of mount, whereas Plan 9's namespaces
are implemented via a namespace walking mechanism in the kernel.

Signed-off-by: Ronald G Minnich <rminnich@gmail.com>
@rminnich rminnich requested review from ericvh, brho, Lencerf and a team July 28, 2023 21:54
@rminnich rminnich merged commit e2749b4 into u-root:main Jul 29, 2023
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants