Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
rootfs: make pivot_root(2) dance handle initramfs case
While pivot_root(2) normally refuses to pivot a mount if you are running with / as initramfs (because initramfs doesn't have a parent mount), you can create a bind-mount and make that a new root to work around this problem. This hack is fairly well known and is used all over the place (see [1,2]) but until now we have forced users to have a far less secure configuration with --no-pivot. There are some minor issues with this trick (the initramfs sticks around at the top of the mount tree, but is completely masked) but they don't really matter for containers. [1]: containers/bubblewrap#592 (comment) [2]: https://aconz2.github.io/2024/07/29/container-from-initramfs.html Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
- Loading branch information