Feature Question: Unshare vs Clone

[adamsmd]

Currently, bubblewrap uses the clone syscall to create a sub-process in a new namespace. However, the unshare syscall could also be used to move the current process into a namespace without having to create a sub-process. This would result in a faster startup time for bubblewrap (in my benchmarks ~30-50% less startup time) and avoids having an extra wrapper process for each bubblewrap.

• Question 1: Is there a reason for bubblewrap to use clone instead of unshare?

• Question 2: Would there be any issue with adding a flag for people who want to use unshare instead of clone? (I am considering implementing this for my own uses, but I wanted to check whether you would be receptive to a pull request for this and what you would want to see in such a pull request.)

[rusty-snake]

The PID Namespaces of a process can not be changed without a clone.
Big parts of the architecture of bubblewrap are influenced by the now removed option for suid usage.

[adamsmd]

Good point about the PID namespace. Perhaps we could give an error both --unshare-pid is set and the unshare mode is set.

[smcv]

If you have highly specific requirements for how namespace creation happens, you might be better off writing your own tool that matches your requirements exactly.

Would there be any issue with adding a flag for people who want to use unshare instead of clone?

The usual issue with new features: the more code paths there are, the more likely it is that one of them regresses as a result of a well-intentioned change elsewhere.