Код: Выделить всё
/bin/lsКод: Выделить всё
pub async fn run(cxt: cfg::Context, file: String) -> ChariotResult {
...
let mut stack = [0u8; 1024 * 1024];
let flags = CloneFlags::empty()
.union(CloneFlags::CLONE_NEWUSER)
.union(CloneFlags::CLONE_NEWNET)
.union(CloneFlags::CLONE_NEWPID)
.union(CloneFlags::CLONE_NEWNS);
let pid = unsafe {
nix::sched::clone(
Box::new(|| match run_container(cxt.clone(), container.clone()) {
Ok(()) => 0,
Err(e) => {
tracing::error!("Failed to run container: {e}");
-1
}
}),
&mut stack,
flags,
// The SIGCHLD signal is required for wait/waitpid;
// otherwise, ECHILD will be reported.
Some(libc::SIGCHLD),
)?
};
...
}
fn run_container(cxt: cfg::Context, container: Container) -> ChariotResult {
...
pivot_root(rootfs.as_str(), rootfs.as_str())?;
// Change working directory to '/'.
chdir("/")?;
// execute `container entrypoint`
let cmd = CString::new(container.entrypoint.as_bytes())?;
let _ = execv(cmd.as_c_str(), &[cmd.as_c_str()]);
Ok(())
}
Подробнее здесь: https://stackoverflow.com/questions/790 ... pivot-root