Tank.Runtime.Rootfs (Tank v0.1.0)

Copy Markdown View Source

Host-side container rootfs bring-up, run during the Linx.Process :ready checkpoint. Builds the container's filesystem inside its mount namespace and pivots into it, leaving the workload ready to execve.

Every step runs in the child's mount namespace via in: {:pid, host_pid}. The sequence mirrors the proven Linx M2 bring-up:

  1. make / rec-private — sever mount propagation so nothing leaks back to the host (a child's mount ns is a shared peer of the host's).
  2. bind rootfs → rootfs, make it private — pivot_root requires the new root to be a private mount point.
  3. /proc — mounted pidns-aware (Linx forks into the container's PID namespace, so /proc shows the container's pids).
  4. /dev — a fresh tmpfs with the standard device nodes bind-mounted from the host (mknod is barred in containers; binds are the way).
  5. /sys — recursive bind of the host's sysfs.
  6. pivot_root into rootfs, then detach the old root.

All mounts are set up under rootfs and come along with the pivot.

Summary

Functions

setup(host_pid, rootfs, etc_files \\ [])

Bring up rootfs for the container parked at host_pid. On success the child's mount namespace has rootfs as /, with /proc, /dev, and /sys populated. Returns the first error encountered.

Functions

setup(host_pid, rootfs, etc_files \\ [])

@spec setup(pos_integer(), Path.t(), [{Path.t(), Path.t()}]) :: :ok | {:error, term()}

Bring up rootfs for the container parked at host_pid. On success the child's mount namespace has rootfs as /, with /proc, /dev, and /sys populated. Returns the first error encountered.

etc_files is a list of {host_path, in_rootfs_path} to bind into the rootfs before the pivot — per-pod files (e.g. /etc/resolv.conf, /etc/hosts) that must not mutate the shared, content-addressed image rootfs.