Refactor mount operations to use procfd and new mount API by giuseppe · Pull Request #2094 · containers/crun

giuseppe · 2026-05-15T13:56:05Z

Open a /proc fd early and thread it through all mount helpers, replacing hardcoded /proc/self/fd string paths with fd-relative operations. This removes the dependency on /proc being mounted during container setup.
Migrate mount operations to the new mount API (fsopen/fsmount/move_mount/mount_setattr).
Move pivot_root before container mounts and defer mount namespace creation (CLONE_NEWNS) to libcrun_do_pivot_root(), consolidating it in a single location.
Add OPEN_TREE_NAMESPACE support (kernel 7.0+) to replace the unshare(CLONE_NEWNS) + bind mount rootfs + pivot_root sequence entirely.

Closes #2086

gemini-code-assist

Code Review

This pull request refactors the container mount logic to utilize the new Linux mount API, enabling detached mounts and the pre-opening of file descriptors before pivot_root to maintain access to host paths. It introduces setup_mount_namespace, adds support for MS_SYNCHRONOUS and MS_DIRSYNC flags, and enhances rootless device node handling. The review feedback identifies several bugs related to empty path strings when processing the root directory and suggests using AT_FDCWD for consistent directory descriptor resolution.

gemini-code-assist · 2026-05-15T14:00:29Z

+          if (get_private_data (container)->mount_fds)
+            {
+              struct libcrun_fd_map *mount_fds = get_private_data (container)->mount_fds;


Directly checking get_private_data (container)->mount_fds might skip pre-opening bind mounts if no non-bind mounts have been processed yet (as mount_fds is lazily initialized). Use get_fd_map (container) to ensure the map is initialized before use.

struct libcrun_fd_map *mount_fds = get_fd_map (container); if (mount_fds) {

gemini-code-assist · 2026-05-15T14:00:29Z

+                  if (old_root_fd >= 0 && source && source[0] == '/')
+                    {
+                      crun_error_release (&tmp_err);
+                      bindfd = get_bind_mount (old_root_fd, source + 1,


If source is exactly /, source + 1 will be an empty string. get_bind_mount calls syscall_open_tree, which requires the AT_EMPTY_PATH flag to handle an empty path. Since get_bind_mount does not currently pass this flag, the call will fail. Using . instead of an empty string avoids this issue.

bindfd = get_bind_mount (old_root_fd, (source[1] == '\0') ? "." : source + 1,

gemini-code-assist · 2026-05-15T14:00:29Z

-                      if (UNLIKELY (ret < 0))
-                        return crun_make_error (err, errno, "bind mount `/sys` from the host");
+                      crun_error_release (err);
+                      mountfd = get_bind_mount (-1, "/sys", true, false, false, MS_PRIVATE, err);


Use AT_FDCWD instead of -1 for the directory file descriptor to ensure standard behavior for relative path resolution in get_bind_mount.

mountfd = get_bind_mount (AT_FDCWD, "/sys", true, false, false, MS_PRIVATE, err);

gemini-code-assist · 2026-05-15T14:00:29Z

-      /* Do not resolve the symlink only when src-nofollow and copy-symlink are used.  */
-      ret = get_file_type (&src_mode, (extra_flags & (OPTION_SRC_NOFOLLOW | OPTION_COPY_SYMLINK)) ? true : false, path);
+          if (old_root_fd >= 0)
+            ret = get_file_type_at (old_root_fd, &src_mode, nofollow, path + 1);


If path is exactly /, path + 1 will be an empty string. get_file_type_at only applies the AT_EMPTY_PATH flag if the path argument is NULL. Passing an empty string will result in an ENOENT error. Suggest passing NULL when the path is the root directory.

ret = get_file_type_at (old_root_fd, &src_mode, nofollow, (path[1] == '\0') ? NULL : path + 1);

gemini-code-assist · 2026-05-15T14:00:29Z

+          if (old_root_fd >= 0 && mount->source && mount->source[0] == '/')
+            {
+              bind_dirfd = old_root_fd;
+              bind_source = mount->source + 1;


If mount->source is exactly /, mount->source + 1 will be an empty string, which causes get_bind_mount to fail as it lacks the AT_EMPTY_PATH flag for its internal open_tree call. Using . ensures the directory itself is opened correctly.

bind_source = (mount->source[1] == '\0') ? "." : mount->source + 1;

gemini-code-assist · 2026-05-15T14:00:29Z

+                {
+                  libcrun_error_t tmp_err = NULL;
+
+                  mount_fds->fds[i] = get_bind_mount (-1, def->mounts[i]->source,


Use AT_FDCWD instead of -1 for the directory file descriptor to ensure standard behavior for relative path resolution in get_bind_mount.

mount_fds->fds[i] = get_bind_mount (AT_FDCWD, def->mounts[i]->source,

packit-as-a-service · 2026-05-15T14:06:50Z