Skip to content

Avoid intermediary bwrap process #684

@N-R-K

Description

@N-R-K

I've been experimenting with bwrap as a way to run some local servers in a restricted environment. I'm using --unshare-all --share-net --as-pid-1
(and a bunch of binds irrelevant for this issue).

For the most part, things are working pretty well. Except one issue which is very close to a deal-breaker: bwrap creates an intermediary process instead of simply exec-ing the command.

The reason why this is important is because service supervisors usually expect the service to be it's direct child: supervisor -> service and communicate with signals. But due to the intermediate process it becomes like this: supervisor -> bwrap -> service which makes signal communication and other usual expectations break.

For example, the stopping the service makes the supervisor kill the bwrap process but the actual service keeps running. --die-with-parent somewhat fixes this, but not in a good manner since SIGKILL doesn't give the service a graceful way to shutdown.

#586 is kind of related and may be enough. But ideally, I want there to be no intermediate process to begin with so that it's a simple, predictable and usual supervisor -> service relation.

So what's the reason for the intermediary process to exist? Can't it just prepare the env and exec() into the child? Any option to do that which I might've missed? Thanks.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions