-
Notifications
You must be signed in to change notification settings - Fork 273
Description
I've been experimenting with bwrap as a way to run some local servers in a restricted environment. I'm using --unshare-all --share-net --as-pid-1
(and a bunch of binds irrelevant for this issue).
For the most part, things are working pretty well. Except one issue which is very close to a deal-breaker: bwrap creates an intermediary process instead of simply exec-ing the command.
The reason why this is important is because service supervisors usually expect the service to be it's direct child: supervisor -> service and communicate with signals. But due to the intermediate process it becomes like this: supervisor -> bwrap -> service which makes signal communication and other usual expectations break.
For example, the stopping the service makes the supervisor kill the bwrap process but the actual service keeps running. --die-with-parent somewhat fixes this, but not in a good manner since SIGKILL doesn't give the service a graceful way to shutdown.
#586 is kind of related and may be enough. But ideally, I want there to be no intermediate process to begin with so that it's a simple, predictable and usual supervisor -> service relation.
So what's the reason for the intermediary process to exist? Can't it just prepare the env and exec() into the child? Any option to do that which I might've missed? Thanks.