Try mounting `/` once

[ezrizhu]

via merger/unionfs

[ezrizhu]

we have good progress on this with root.

root@pashsn3:~# unshare --mount --user --pid --fork /bin/sh
((do gidmapping here # gidmapper 67195 0 0 65535 0 0 65535))
$ pwd
/root
$ mkdir overlay
$ cd overlay
$ mkdir low up merged work
$ mergerfs / low
$ mount -t overlay overlay -o userxattr -o lowerdir=low,upperdir=up,workdir=work merged
$ chroot merged /bin/bash
root@pashsn3:/# touch x
root@pashsn3:/# echo z > x
root@pashsn3:/#

Can not reproduce this with out running as root. Getting EOVERFLOW

[ezrizhu]

Progress also made by @SleepyMug on 0621375

[ezrizhu]

another poc

#!/bin/sh
# Simplified Sys Sandbox Tool

# Record our starting location
START_DIR="$PWD"

# Create sandbox
SANDBOX_DIR=$(mktemp -d)

# Create directories for overlayfs
# upperdir: directory for writable changes
# workdir: directory for overlay operations
# temproot: merged view of the filesystem
mkdir -p "$SANDBOX_DIR/upperdir" \
    "$SANDBOX_DIR/workdir" \
    "$SANDBOX_DIR/merger" \
    "$SANDBOX_DIR/temproot"

# Make tempfiles to store executables
mount_and_execute=$(mktemp)
chroot_executable=$(mktemp)

# executable for the outer unshare
cat >"$mount_and_execute" <<EOF
#!/bin/sh

# loop to mount the overlays

mergerfs / "$SANDBOX_DIR"/merger
mount -t overlay overlay -o lowerdir="$SANDBOX_DIR"/merger,upperdir="$SANDBOX_DIR"/upperdir,workdir="$SANDBOX_DIR"/workdir "$SANDBOX_DIR"/temproot

# mount the dev directory
mount --rbind /dev  \
    "$SANDBOX_DIR/temproot/dev"

# enter into the inner unshare
unshare --root="$SANDBOX_DIR/temproot"\
    /bin/sh "$chroot_executable"
EOF

# executable for the inner overlay
cat >"$chroot_executable" <<EOF
#!/bin/sh

# mount procfs and execute our command
# in the sandbox
mount -t proc proc /proc &&
cd $START_DIR &&
exec $@
EOF

chmod +x "$mount_and_execute" "$chroot_executable"

# enter into the outer unshare
unshare --mount --map-root-user --user \
    --pid --fork \
    "$mount_and_execute"

[mgree]

I don't understand this issue. What is it trying to do, and why?

[ezrizhu]

Currently we are mounting each dir in / separately, however it appears we can also just mergerfs mount "/" once, we have mostly got it working for try-rs and also in the shell script version, however currently im running into some EOVERFLOW that im working on resolving.— EzriOn Jun 18, 2025, at 08:51, Michael Greenberg ***@***.***> wrote:mgree left a comment (binpash/try#90) I don't understand this issue. What is it trying to do, and why? —Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you were assigned.Message ID: ***@***.***>