Replace the manual handling of mounts with the contianerd's mount package

go.mod

@@ -11,10 +11,11 @@ require (
 	github.com/containerd/log v0.1.0
 	github.com/containerd/ttrpc v1.2.8
 	github.com/creack/pty v1.1.24
+	github.com/cyphar/filepath-securejoin v0.5.2
 	github.com/elastic/go-seccomp-bpf v1.6.0
 	github.com/hashicorp/go-version v1.9.0
 	github.com/jackpal/gateway v1.2.0
-	github.com/moby/sys/mount v0.3.5
+	github.com/moby/sys/mountinfo v0.7.2
 	github.com/moby/sys/userns v0.1.0
 	github.com/nubificus/hedge_cli v0.0.3
 	github.com/onsi/ginkgo/v2 v2.28.1
@@ -62,7 +63,6 @@ require (
 	github.com/klauspost/compress v1.18.6 // indirect
 	github.com/mattn/go-colorable v0.1.15 // indirect
 	github.com/mattn/go-isatty v0.0.22 // indirect
-	github.com/moby/sys/mountinfo v0.7.2 // indirect
 	github.com/moby/sys/sequential v0.7.0 // indirect
 	github.com/moby/sys/user v0.4.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect

go.sum

@@ -145,8 +145,6 @@ github.com/mfridman/tparse v0.18.0 h1:wh6dzOKaIwkUGyKgOntDW4liXSo37qg5AXbIhkMV3v
 github.com/mfridman/tparse v0.18.0/go.mod h1:gEvqZTuCgEhPbYk/2lS3Kcxg1GmTxxU7kTC8DvP0i/A=
 github.com/moby/sys/capability v0.4.0 h1:4D4mI6KlNtWMCM1Z/K0i7RV1FkX+DBDHKVJpCndZoHk=
 github.com/moby/sys/capability v0.4.0/go.mod h1:4g9IK291rVkms3LKCDOoYlnV8xKwoDTpIrNEE35Wq0I=
-github.com/moby/sys/mount v0.3.5 h1:eS3fsZTjHaBihwjp4/+5Z3jxqLXYsbwxqpVSfFv3M00=
-github.com/moby/sys/mount v0.3.5/go.mod h1:WUQDO+/uCiCIkIztx8SrwIDVn2dtMFRBebRhpDFT71M=
 github.com/moby/sys/mountinfo v0.7.2 h1:1shs6aH5s4o5H2zQLn796ADW1wMrIwHsyJ2v9KouLrg=
 github.com/moby/sys/mountinfo v0.7.2/go.mod h1:1YOa8w8Ih7uW0wALDUgT1dTTSBrZ+HiBLGws92L2RU4=
 github.com/moby/sys/sequential v0.7.0 h1:ASQNGNROJSuOO6LL6bPHbKvuZu6NU8P4ldPWk31zj/8=

pkg/unikontainers/block.go

@@ -22,12 +22,12 @@ import (
 	"path/filepath"
 	"strings"
 
-	"golang.org/x/sys/unix"
-
-	"github.com/moby/sys/mount"
+	"github.com/containerd/containerd/mount"
+	"github.com/moby/sys/mountinfo"
 	"github.com/opencontainers/runtime-spec/specs-go"
 	"github.com/sirupsen/logrus"
 	"github.com/urunc-dev/urunc/pkg/unikontainers/types"
+	"golang.org/x/sys/unix"
 )
 
 // TODO: Find and set the correct size for the tmpfs in the host
@@ -157,7 +157,7 @@ func copyMountfiles(targetPath string, mounts []specs.Mount) error {
 		if m.Type != "bind" {
 			continue
 		}
-		err := fileFromHost(targetPath, m.Source, m.Destination, 0, true)
+		err := fileFromHost(targetPath, m.Source, m.Destination)
 		if (err != nil) && !errors.Is(err, ErrCopyDir) {
 			return err
 		}
@@ -189,7 +189,7 @@ func handleExplicitBlockImage(blockImg string, mountPoint string) (types.BlockDe
 
 // Search all the mount entries in the container's config and
 // find the ones that come from a block.
-func getBlockVolumes(monRootfs string, mounts []specs.Mount, ukernel types.Unikernel) ([]types.BlockDevParams, error) {
+func getBlockVolumes(mounts []specs.Mount, ukernel types.Unikernel) ([]types.BlockDevParams, error) {
 	blkImgs := []types.BlockDevParams{}
 	for i, m := range mounts {
 		// We check only bind mounts
@@ -208,15 +208,26 @@ func getBlockVolumes(monRootfs string, mounts []specs.Mount, ukernel types.Unike
 			return nil, err
 		}
 		if ukernel.SupportsFS(mInfo.FsType) {
-			err = mount.Unmount(mInfo.MountPoint)
+			// So, there was an issue which was manifested from the testing.
+			// If we have a file (e.g. ext2) and mount it, then we use
+			// a loop device for the mount and this is what is shown
+			// in the mount list. However, since we perform the unmount
+			// the device might also get removed. See
+			// https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-block-loop
+			// If the device gets removed, then we attach nothing to the
+			// sandbox. TO resolve this we remove the autoclear flag
+			// and therefore the device will persist.
+			cleared, err := setLoopAutoclear(mInfo.Source, false)
 			if err != nil {
 				return nil, err
 			}
-			err = setupDev(monRootfs, mInfo.Source)
+			mInfo.LoopAutoclear = cleared
+			err = mount.Unmount(mInfo.MountPoint, 0)
 			if err != nil {
 				return nil, err
 			}
 			mInfo.ID = fmt.Sprintf("vol%d", i)
+			mInfo.HostMountPoint = mInfo.MountPoint
 			mInfo.MountPoint = m.Destination
 			blkImgs = append(blkImgs, mInfo)
 		}
@@ -225,6 +236,105 @@ func getBlockVolumes(monRootfs string, mounts []specs.Mount, ukernel types.Unike
 	return blkImgs, nil
 }
 
+// restoreBlockVolumes mounts the block volume sources that were unmounted
+// during create
+func restoreBlockVolumes(blockArgs []types.BlockDevParams) error {
+	for _, b := range blockArgs {
+		// Only volumes gathered from the container's mounts carry the
+		// host mountpoint where their source was originally mounted.
+		if b.HostMountPoint == "" {
+			continue
+		}
+		mounted, err := mountinfo.Mounted(b.HostMountPoint)
+		if err != nil {
+			return fmt.Errorf("failed to check if %s is a mountpoint: %w", b.HostMountPoint, err)
+		}
+		if mounted {
+			continue
+		}
+
+		err = unix.Mount(b.Source, b.HostMountPoint, b.FsType, 0, "")
+		if err != nil {
+			return fmt.Errorf("failed to remount %s at %s: %w", b.Source, b.HostMountPoint, err)
+		}
+
+		if b.LoopAutoclear {
+			_, err = setLoopAutoclear(b.Source, true)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+// setLoopAutoclear sets or clears the autoclear flag of a loop device and
+// returns true when the flag was changed. It returns false without an error
+// when the path is not a loop device or the flag already has the wanted value.
+func setLoopAutoclear(devPath string, autoclear bool) (bool, error) {
+	_, err := os.Stat(filepath.Join("/sys/class/block", filepath.Base(devPath), "loop"))
+	if os.IsNotExist(err) {
+		// Not a loop device
+		return false, nil
+	}
+	if err != nil {
+		return false, err
+	}
+
+	dev, err := os.OpenFile(devPath, os.O_RDWR, 0)
+	if err != nil {
+		return false, fmt.Errorf("failed to open %s: %w", devPath, err)
+	}
+	defer dev.Close()
+
+	info, err := unix.IoctlLoopGetStatus64(int(dev.Fd()))
+	if err != nil {
+		return false, fmt.Errorf("failed to get the status of %s: %w", devPath, err)
+	}
+	if autoclear == (info.Flags&unix.LO_FLAGS_AUTOCLEAR != 0) {
+		return false, nil
+	}
+
+	if autoclear {
+		info.Flags |= unix.LO_FLAGS_AUTOCLEAR
+	} else {
+		info.Flags &^= unix.LO_FLAGS_AUTOCLEAR
+	}
+	err = unix.IoctlLoopSetStatus64(int(dev.Fd()), info)
+	if err != nil {
+		return false, fmt.Errorf("failed to set the status of %s: %w", devPath, err)
+	}
+
+	return true, nil
+}
+
+// blockDevNodes transforms a list of types.BlockDevParams to a list of
+// specs.LinuxDevice which cna be then used for replicating these block
+// devices form the host to the monitor's execution environment.
+func blockDevNodes(blockArgs []types.BlockDevParams, rootfs types.RootfsParams) ([]specs.LinuxDevice, error) {
+	if rootfs.Type != "block" {
+		return nil, nil
+	}
+
+	var blockDevs []specs.LinuxDevice
+	for _, b := range blockArgs {
+		// The rootfs device is a real host device only when a container rootfs
+		// was converted to a block device (MountedPath set). When it is an
+		// explicit block image referenced by an annotation, no node is created.
+		if b.Source == rootfs.Path && rootfs.MountedPath == "" {
+			continue
+		}
+		bDev, err := deviceFromHost(b.Source)
+		if err != nil {
+			return nil, err
+		}
+		blockDevs = append(blockDevs, bDev)
+	}
+
+	return blockDevs, nil
+}
+
 func (b blockRootfs) preSetup() error {
 	if b.mountedPath == "" {
 		return nil
@@ -242,7 +352,7 @@ func (b blockRootfs) preSetup() error {
 		return fmt.Errorf("failed to extract boot files from rootfs: %w", err)
 	}
 
-	err = mount.Unmount(b.mountedPath)
+	err = mount.Unmount(b.mountedPath, 0)
 	if err != nil {
 		return fmt.Errorf("failed to unmount rootfs: %w", err)
 	}
@@ -251,21 +361,11 @@ func (b blockRootfs) preSetup() error {
 }
 
 func (b blockRootfs) postSetup() error {
-	if b.mountedPath != "" {
-		err := setupDev(b.monRootfs, b.path)
-		if err != nil {
-			return err
-		}
-	}
-
-	err := createTmpfs(b.monRootfs, "/tmp",
-		unix.MS_NOSUID|unix.MS_NOEXEC|unix.MS_STRICTATIME,
-		"1777", tmpfsSizeForBlockRootfs)
-	if err != nil {
-		err = fmt.Errorf("failed to create tmpfs for monitor's execution environment: %w", err)
-	}
+	return nil
+}
 
-	return err
+func (b blockRootfs) getMounts() ([]specs.Mount, error) {
+	return []specs.Mount{tmpfsMount("/tmp", tmpfsSizeForBlockRootfs)}, nil
 }
 
 func (b blockRootfs) getBlockDevs() ([]types.BlockDevParams, error) {
@@ -285,7 +385,7 @@ func (b blockRootfs) getBlockDevs() ([]types.BlockDevParams, error) {
 	}
 
 	blockArgs = append(blockArgs, rootfsBlock)
-	blockFromMounts, err := getBlockVolumes(b.monRootfs, b.mounts, b.guest)
+	blockFromMounts, err := getBlockVolumes(b.mounts, b.guest)
 	if err != nil {
 		return nil, err
 	}

pkg/unikontainers/initrd_rootfs.go

@@ -17,8 +17,6 @@ package unikontainers
 import (
 	"fmt"
 
-	"golang.org/x/sys/unix"
-
 	"github.com/opencontainers/runtime-spec/specs-go"
 	"github.com/urunc-dev/urunc/pkg/unikontainers/initrd"
 	"github.com/urunc-dev/urunc/pkg/unikontainers/types"
@@ -43,14 +41,11 @@ func (i initrdRootfs) postSetup() error {
 		return fmt.Errorf("failed to update guest's initrd: %w", err)
 	}
 
-	err = createTmpfs(i.monRootfs, "/tmp",
-		unix.MS_NOSUID|unix.MS_NOEXEC|unix.MS_STRICTATIME,
-		"1777", tmpfsSizeForInitrdRootfs)
-	if err != nil {
-		err = fmt.Errorf("failed to create tmpfs for monitor's execution environment: %w", err)
-	}
+	return nil
+}
 
-	return err
+func (i initrdRootfs) getMounts() ([]specs.Mount, error) {
+	return []specs.Mount{tmpfsMount("/tmp", tmpfsSizeForInitrdRootfs)}, nil
 }
 
 func (i initrdRootfs) getBlockDevs() ([]types.BlockDevParams, error) {