container: recover from intermittent EACCES

This change works around a race in the vfs, where ACLs are ineffective
for a very short window of time while they are being written.

This remained undiscovered until now due to the previous integration
test suite's complete inability to handle concurrency (the nixos vm test
machinery could not even support python multithreading). At the time, it
was deemed unnecessary to run this kind of test in the integration vm,
as the entire container package up to the syscall wrappers had full test
coverage and plenty of tests for race conditions, and a race in vfs was
simply unexpected.

This workaround adds around 60 milliseconds of latency for a truly
inaccessible path. While this is not ideal, it is somewhat cheaper and
a lot easier to implement than synchronising container startup all the
way up from shim to the priv-side process. Regardless, EACCES should not
occur at all during regular use, and a 60-millisecond delay during
application development is hardly a problem.

Signed-off-by: Ophestra <cat@gensokyo.uk>

0 files changed, 0 insertions, 0 deletions