From 38245559dca0833dc078b982d59490eee53e168c Mon Sep 17 00:00:00 2001 From: Ophestra Date: Sun, 3 Aug 2025 19:18:53 +0900 Subject: container/ops: mount dev readonly There is usually no good reason to write to /dev. This however doesn't work in internal/app because FilesystemConfig supplied by ContainerConfig might add entries to /dev, so internal/app follows DevWritable with Remount instead. Signed-off-by: Ophestra --- internal/app/app_nixos_linux_test.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'internal/app/app_nixos_linux_test.go') diff --git a/internal/app/app_nixos_linux_test.go b/internal/app/app_nixos_linux_test.go index 2db3bf8a..a0da52c0 100644 --- a/internal/app/app_nixos_linux_test.go +++ b/internal/app/app_nixos_linux_test.go @@ -118,7 +118,7 @@ var testCasesNixos = []sealTestCase{ Ops: new(container.Ops). Proc("/proc"). Tmpfs(hst.Tmp, 4096, 0755). - Dev("/dev", true). + DevWritable("/dev", true). Bind("/bin", "/bin", 0). Bind("/usr/bin", "/usr/bin", 0). Bind("/nix/store", "/nix/store", 0). @@ -131,6 +131,7 @@ var testCasesNixos = []sealTestCase{ Bind("/run/opengl-driver", "/run/opengl-driver", 0). Bind("/dev/dri", "/dev/dri", container.BindDevice|container.BindWritable|container.BindOptional). Etc("/etc", "8e2c76b066dabe574cf073bdb46eb5c1"). + Remount("/dev", syscall.MS_RDONLY). Tmpfs("/run/user", 4096, 0755). Bind("/tmp/hakurei.1971/runtime/1", "/run/user/1971", container.BindWritable). Bind("/tmp/hakurei.1971/tmpdir/1", "/tmp", container.BindWritable). -- cgit v1.3.1