5c4deb9a5c
Consider such configuration: $ systemd-nspawn --read-only --timezone=copy --resolv-conf=copy-host \ --overlay="+/etc::/etc" <...> Assuming one wants `/` to be read-only, DNS and `/etc/localtime` to work. One way to do it is to create an overlay filesystem in `/etc/`. However, systemd-nspawn tries to create `/etc/resolv.conf` and `/etc/localtime` before mounting the custom paths, while `/` (and, by extension, `/etc`) is read-only. Thus it fails to create those files. Mounting custom paths before modifying anything in `/etc/` makes this possible. Full example: ``` $ debootstrap buster /var/lib/machines/t1 http://deb.debian.org/debian $ systemd-nspawn --private-users=false --timezone=copy --resolv-conf=copy-host --read-only --tmpfs=/var --tmpfs=/run --overlay="+/etc::/etc" -D /var/lib/machines/t1 ping -c 1 example.com Spawning container t1 on /var/lib/machines/t1. Press ^] three times within 1s to kill container. ping: example.com: Temporary failure in name resolution Container t1 failed with error code 130. ``` With the patch: ``` $ sudo ./build/systemd-nspawn --private-users=false --timezone=copy --resolv-conf=copy-host --read-only --tmpfs=/var --tmpfs=/run --overlay="+/etc::/etc" -D /var/lib/machines/t1 ping -qc 1 example.com Spawning container t1 on /var/lib/machines/t1. Press ^] three times within 1s to kill container. PING example.com (93.184.216.34) 56(84) bytes of data. --- example.org ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 110.912/110.912/110.912/0.000 ms Container t1 exited successfully. ``` |
||
---|---|---|
.. | ||
meson.build | ||
nspawn-cgroup.c | ||
nspawn-cgroup.h | ||
nspawn-def.h | ||
nspawn-expose-ports.c | ||
nspawn-expose-ports.h | ||
nspawn-gperf.gperf | ||
nspawn-mount.c | ||
nspawn-mount.h | ||
nspawn-network.c | ||
nspawn-network.h | ||
nspawn-oci.c | ||
nspawn-oci.h | ||
nspawn-patch-uid.c | ||
nspawn-patch-uid.h | ||
nspawn-register.c | ||
nspawn-register.h | ||
nspawn-seccomp.c | ||
nspawn-seccomp.h | ||
nspawn-settings.c | ||
nspawn-settings.h | ||
nspawn-setuid.c | ||
nspawn-setuid.h | ||
nspawn-stub-pid1.c | ||
nspawn-stub-pid1.h | ||
nspawn.c | ||
test-nspawn-tables.c | ||
test-patch-uid.c |