run (3252B)
1 #!/command/execlineb -P 2 fdmove -c 2 1 3 4 s6-envdir env 5 multisubstitute { 6 importas -i -u CONTAINER_NAME CONTAINER_NAME 7 importas -i -u CONTAINER_USER CONTAINER_USER 8 importas -i -u vtN vtN 9 define XDG_RUNTIME_DIR /run/X 10 } 11 export XDG_RUNTIME_DIR $XDG_RUNTIME_DIR 12 backtick -in CONTAINER_USER_HOME { homeof $CONTAINER_USER } 13 multisubstitute { 14 importas -i -u CONTAINER_USER_HOME CONTAINER_USER_HOME 15 define CONTAINER_TMPFS /run/containers/${CONTAINER_NAME}.${CONTAINER_USER} 16 define -s tmpfs_dirs "run tmp run/inbox run/shm tmp/.X11-unix" 17 importas -D ns -s -C -u CONTAINER_MNT_DIRS CONTAINER_MNT_DIRS 18 } 19 20 getpid NS_PID 21 foreground { 22 importas -i NS_PID NS_PID 23 if { test -d /run/cgroup } 24 if { mkdir -p /run/cgroup/containers/${CONTAINER_USER}/${CONTAINER_NAME} } 25 redirfd -w 1 /run/cgroup/containers/${CONTAINER_USER}/${CONTAINER_NAME}/cgroup.procs 26 printf "%s" ${NS_PID} 27 } 28 29 if { rm -rf ${CONTAINER_TMPFS} } 30 if { mkdir -p ${CONTAINER_TMPFS}/${tmpfs_dirs} ${CONTAINER_TMPFS}/mnt/${CONTAINER_MNT_DIRS} } 31 if { chmod 1770 ${CONTAINER_TMPFS}/${tmpfs_dirs} } 32 if { chown root:${CONTAINER_USER} ${CONTAINER_TMPFS}/${tmpfs_dirs} } 33 34 # Xauthority 35 if { mkdir -p ${CONTAINER_TMPFS}${XDG_RUNTIME_DIR} } 36 if { truncate -s 0 ${CONTAINER_TMPFS}${XDG_RUNTIME_DIR}/Xauthority } 37 if { chmod 600 ${CONTAINER_TMPFS}${XDG_RUNTIME_DIR}/Xauthority } 38 if { chown ${CONTAINER_USER}:${CONTAINER_USER} ${CONTAINER_TMPFS}${XDG_RUNTIME_DIR}/Xauthority } 39 if { chown ${CONTAINER_USER}:${CONTAINER_USER} ${CONTAINER_TMPFS}${XDG_RUNTIME_DIR} } 40 41 # # Create default resolv.conf 42 # if { redirfd -w 1 ${CONTAINER_TMPFS}/run/resolv.conf printf "nameserver 127.0.0.1\n" } 43 # if { chown ${CONTAINER_USER}:${CONTAINER_USER} ${CONTAINER_TMPFS}/run/resolv.conf } 44 45 # Put UID/GID/GIDLIST into environment for use by applyuidgid-caps below 46 s6-envuidgid ${CONTAINER_USER} 47 48 export HOST ${CONTAINER_NAME} 49 50 emptyenv -c 51 unshare -n -m -u -i # new net, mount, UTS and IPC namespaces 52 if { ip addr add 127.0.0.1/8 dev lo } 53 if { ip addr add ::1/128 dev lo } 54 if { ip link set lo up } 55 ns_run_unshared data/root { 56 # pre pivot-root commands 57 if { mount -o bind,ro /etc/passwd ./etc/passwd } 58 if { mount -o bind,ro /etc/group ./etc/group } 59 60 if { mount -o bind /dev/dri ./dev/dri } 61 if { mount -o bind /dev/input ./dev/input } 62 63 # fixup permissions 64 if { chgrp -R video ./dev/dri } 65 if { chmod g+rw ./dev/dri/card0 } 66 67 if { chgrp -R input ./dev/input } 68 if { chmod -R g+rw ./dev/input/mice } 69 70 if { cp -a /dev/tty0 ./dev/tty0 } 71 if { chmod 660 ./dev/tty0 } 72 if { chown root:xorg ./dev/tty0 } 73 74 if { cp -a /dev/tty${vtN} ./dev/tty${vtN} } 75 if { chmod 660 ./dev/tty${vtN} } 76 if { chown root:xorg ./dev/tty${vtN} } 77 } 78 # This runs with changed / so use absolute paths before dropping privs 79 /mnt/ns/bin/redirfd -r 0 /dev/tty${vtN} 80 /mnt/ns/bin/redirfd -w 1 /dev/tty${vtN} 81 /mnt/ns/bin/applyuidgid-caps -U "^CAP_SYS_TTY_CONFIG" 82 env HOME=${CONTAINER_USER_HOME} USER=${CONTAINER_USER} 83 84 if { 85 pipeline { 86 if { printf "add :%d . " ${vtN} } 87 if { redirfd -r 0 /dev/urandom busybox xxd -p -l 16 } 88 } 89 xauth -f ${XDG_RUNTIME_DIR}/Xauthority source - 90 } 91 92 Xorg 93 -displayfd 3 94 -nolisten local 95 -nolisten tcp 96 -quiet 97 -logfile ${XDG_RUNTIME_DIR}/log 98 -auth ${XDG_RUNTIME_DIR}/Xauthority 99 -tst 100 -retro 101 -novtswitch 102 vt${vtN} :${vtN}