Assemble supported sandbox roots with detached mounts - #788
Open
domenkozar wants to merge 1 commit into
Open
Conversation
Build simple unprivileged user/PID namespace layouts in a detached tmpfs and enter the finished root with one pivot instead of staging two roots. Use descriptor-based new mount APIs for filesystem creation, recursive binds and attachment while preserving inherited mount restrictions. Select this backend automatically for supported setup operations. Keep the existing backend for other layouts, missing libc interfaces, missing syscalls and kernels without detached-tree composition. Probe detached cloning and attachment using disposable clones of the real empty root, then retain the untouched root for actual setup. Permission denials and failures after backend selection remain fatal. Add focused coverage for mount policy, descriptor/capability cleanup, layout selection and unsupported or denied kernel operations. Against upstream 26bb788 on Linux 7.0.10 / Ryzen 7 7840S (16 logical CPUs), complete static-shell launches take 22.8-28.3% less amortized time with four concurrent launches, including the compatibility probe. Serial launch medians improve by 3.4-18.6%, depending on layout. Median milliseconds per launch (upstream -> patched): Layout Serial Four concurrent Minimal 3.421 -> 2.785 1.679 -> 1.203 Standard + 3 5.208 -> 5.032 2.409 -> 1.838 Standard + 32 6.449 -> 5.523 2.754 -> 2.091 Standard + 128 10.439 -> 8.816 3.306 -> 2.554 Standard layouts include user/PID/network/IPC/UTS namespaces, proc, dev, tmpfs, a read-only static executable and the indicated input-file binds. Both binaries use GCC 15.2.0 and matching Meson release builds. Each cell has 12 alternating matched pairs of 32 fresh launches with shuffled case order; timings include process creation, setup, execution and cleanup. Four-concurrent values measure throughput cost, not individual latency. The unchanged root-overmount control differs by 2.0% serially and 0.7% concurrently. The direct-command control differs by 5.1% (17 us) serially and 1.5% concurrently. These tiny-payload measurements are host-specific, not a guarantee of the same improvement for longer-running commands.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Build simple unprivileged user/PID namespace layouts in a detached tmpfs and enter the finished root with one pivot instead of staging two roots. Use descriptor-based new mount APIs for filesystem creation, recursive binds and attachment while preserving inherited mount restrictions.
Select this backend automatically for supported setup operations. Keep the existing backend for other layouts, missing libc interfaces, missing syscalls and kernels without detached-tree composition. Probe detached cloning and attachment using disposable clones of the real empty root, then retain the untouched root for actual setup.
Permission denials and failures after backend selection remain fatal. Add focused coverage for mount policy, descriptor/capability cleanup, layout selection and unsupported or denied kernel operations.
Against upstream 26bb788 on Linux 7.0.10 / Ryzen 7 7840S (16 logical CPUs), complete static-shell launches take 22.8-28.3% less amortized time with four concurrent launches, including the compatibility probe. Serial launch medians improve by 3.4-18.6%, depending on layout.
Median milliseconds per launch (upstream -> patched):
Layout Serial Four concurrent
Minimal 3.421 -> 2.785 1.679 -> 1.203
Standard + 3 5.208 -> 5.032 2.409 -> 1.838
Standard + 32 6.449 -> 5.523 2.754 -> 2.091
Standard + 128 10.439 -> 8.816 3.306 -> 2.554
Standard layouts include user/PID/network/IPC/UTS namespaces, proc, dev, tmpfs, a read-only static executable and the indicated input-file binds. Both binaries use GCC 15.2.0 and matching Meson release builds. Each cell has 12 alternating matched pairs of 32 fresh launches with shuffled case order; timings include process creation, setup, execution and cleanup. Four-concurrent values measure throughput cost, not individual latency.
The unchanged root-overmount control differs by 2.0% serially and 0.7% concurrently. The direct-command control differs by 5.1% (17 us) serially and 1.5% concurrently. These tiny-payload measurements are host-specific, not a guarantee of the same improvement for longer-running commands.
All done by GPT6.