Re: [Virtio-fs] [PATCH v3] virtiofsd: add container-friendly -o sandbox=chroot option

[Vivek Goyal]

On Mon, Oct 19, 2020 at 06:43:41PM +0900, Chirantan Ekbote wrote:
> On Thu, Oct 8, 2020 at 5:55 PM Stefan Hajnoczi <stefanha@redhat.com> wrote:
> >
> > virtiofsd cannot run in a container because CAP_SYS_ADMIN is required to
> > create namespaces.
> >
> 
> In crosvm we deal with this by also creating a user namespace, which
> then allows us to create the mount, net, and pid namespaces as well.
> Could that also work for virtiofsd?

I think one key question here is that who does the sandboxing. Is it
the contatiner runtime environment or virtiofsd itself. I think what
stefan is trying to do is that container runtime has done the sandboxing
so virtiofsd has not do it.

Having said that, if container runtime has setup things in such a
way that virtiofsd has CAP_SYS_ADMIN, is it desirable that virtiofsd
does pivot_root() instead of chroot()?

Thanks
Vivek