Re: [PATCH] environment: container: Do not remount network files as read-only.

["Thompson, David" <dthompson2@worcester.edu>]

On Sun, Mar 27, 2016 at 1:43 PM, Ludovic Courtès <ludo@gnu.org> wrote:

> I cannot reproduce the problem with this minimum test case (the two
> ‘mount’ call succeed):
>
> --8<---------------cut here---------------start------------->8---
> (use-modules (guix build syscalls)
>              (gnu build linux-container))
>
> (chdir "/tmp")
> (false-if-exception (delete-file "foo"))
> (false-if-exception (umount "bar"))
> (false-if-exception (delete-file "bar"))
>
> (symlink "/etc/resolv.conf" "foo")
> (close-port (open-output-file "bar"))
> (mount "/tmp/foo" "/tmp/bar" "none" (logior MS_BIND MS_RDONLY))
> (mount "/tmp/foo" "/tmp/bar" "none" (logior MS_BIND MS_RDONLY MS_REMOUNT))
> --8<---------------cut here---------------end--------------->8---
>
> Maybe we should try to throw in ‘call-with-container’ somewhere in there
> to be closer to the actual problem, dunno.
>
> It’s a bit frustrating that we don’t understand the situation.  If you
> wish, I think it’s fine to commit this patch, but please make sure to
> mention that the problem occurs when /etc/resolv.conf is a symlink, and
> add a link to this discussion.

I found the culprit!  This problem occurs with *any* file remounted
read-only from a tmpfs.  In Ubuntu, /etc/resolv.conf is a symlink to
/run/resolvconf/resolv.conf, and /run is a tmpfs.  I did this to
confirm the issue with another file on GuixSD:

echo foobar > /run/user/foo
guix environment --container --expose=/run/user/foo --ad-hoc coreutils

Where /run/user is a tmpfs.  It should fail with an exit status of 1.
I don't know why tmpfs is an issue, nor do I know how work around it.
I've been searching around for answers but haven't found any leads
yet.  Any thoughts?

> (FWIW I’m planning to push have the release ready on Monday night.)

Maybe we'll have to punt on this for the release, but I really hope it
can be fixed in time!  This is the last thing I need to make networked
containers "just work" on Ubuntu-based distros.

- Dave