init.d/root: add support for 'shared' fstab option on /

[martinetd]

containers on linux might require filesystems to be mounted with
different propagation than the kernel default of 'private':
by setting 'shared' in fstab for / options, one can now make the
fs hierarchy shared.

Note we use 'rshared' to make other existing mounts shared as well
because the setting is contagious and it seemed more logical to
behave as if the setting was set on / immediately (and thus inherited
by other mounts)

This fixes #525.

[hosaka]

This should fix the warning message for rootless podman/buildah: containers/buildah#3726

WARN[0000] "/" is not a shared mount, this could cause issues or missing mounts with rootless containers

[martinetd]

This should fix the warning message for rootless podman/buildah: containers/buildah#3726

Yes, that's the main reason I want this :)

(well, that and shared mounts can actually be useful for containers -- with volume mounted as shared it's possible to have an administration container that can issue mount commands for slave, less trusted containers)

[nekopsykose]

was there anything more to do here to allow it to be merged? looks pretty cut and dry to me

[martinetd]

For reference, I've been using something equivalent to this for a bit over a year now without any issue. I'll be more than happy to remove my kludge if/when this is merged :)

[daiaji]

Is that the problem? Strange mistake.

[vampywiz17]

I hope it will merged soon :)

Now i use /var/lib/docker folder all of shared container mounts. This folder shared by default, if docker installed :D

[vapier]

the mount(8) man page says it recognizes the various types in fstab (private, slave, shared, unbindable, rprivate, rslave, rshared, runbindable). we shouldn't treat "shared" as "rshared". if you want --make-rshared, then you need to use "rshared" in fstab, not "shared".

the man page also says that since util-linux 2.23, the fstab propagation flags are respected by mount. i'm guessing this doesn't work for / because the kernel mounted it for us. does mount -o remount / not apply the share settings ? i don't have a system setup atm to easily test, or spelunk code.

[martinetd]

The rationale for using rshared when shared is set on /, is that it is supposed to be inherited -- but since we're setting rootflags late (after other mount points have been made) then we need rshared to behave as if it had been shared from the start. (otherwise you end up with something weird where part of the tree is shared but it's not really clear to users what)

Happy to update the PR to change that though, it's a detail really.

As for mount -o remount / iirc it didn't affect the sharing previously, will retry tomorrow

[thetredev]

Just tested the change in an Alpine 3.18 VM (amd64, system disk). Works fine:

$ cat /etc/fstab
UUID=....	/	ext4	rw,relatime,shared 0 1
....

$ podman run --rm hello-world

Hello from Docker!
....

[btreecat]

@vapier If the PR was changed to use the rshared flag in /etc/fstab so that it was matching the call to mount --make-rshared / would that be satisfactory for merging? Is there additional work you would like to see done first before the PR from @martinetd is accepted?

I would love to see this fixed upstream for everyone! Thank you.

[martinetd]

Ah, I realized I forgot to reply to a point:

As for mount -o remount / iirc it didn't affect the sharing previously, will retry tomorrow

This doesn't just have no effect, mount -o doesn't seem to allow passing shared or other similar options:

alpine:~# mount -o remount,shared / 
mount: mounting /dev/vda3 on / failed: Invalid argument

re: fstab flag, as said before I still think it makes more sense as it is, but happy to do the updating if that's what you want.

[Raboo]

Perhaps there should be a shared and a rshared option? So people explicitly knows that rshared is recursive and shared is not.

[martinetd]

Perhaps there should be a shared and a rshared option? So people explicitly knows that rshared is recursive and shared is not.

This was brought up before so I'll just quote my reply:

The rationale for using rshared when shared is set on /, is that it is supposed to be inherited -- but since we're setting rootflags late (after other mount points have been made) then we need rshared to behave as if it had been shared from the start. (otherwise you end up with something weird where part of the tree is shared but it's not really clear to users what)

To rephrase myself, the shared setting will be inherited by future mounts, so depending on the timing of the "make root shared" you'll get something implementation specific with a simple --make-shared, which I find it hard to believe anyone would want.

It's an easy change so given the above, if someone still think that makes sense I'll be happy to update this PR to at least rename shared to rshared to make it more obvious that it's what we're doing; please re-ask if that's the case.

[Raboo]

Oh sorry, missed that. I actually don't care that much about the details, I just want it implemented.

[btreecat]

@williamh or @vapier Is there anything outstanding preventing this PR from being accepted?