Function ParentMain

pkg/rootlessutil/parent_linux.go:68–131

(hostGatewayIP string)

}

func ParentMain(hostGatewayIP string) error {
	if !IsRootlessParent() {
		return errors.New("should not be called when !IsRootlessParent()")
	}
	stateDir, err := RootlessKitStateDir()
	log.L.Debugf("stateDir: %s", stateDir)
	if err != nil {
		return fmt.Errorf("rootless containerd not running? (hint: use `containerd-rootless-setuptool.sh install` to start rootless containerd): %w", err)
	}
	childPid, err := RootlessKitChildPid(stateDir)
	if err != nil {
		return err
	}

	detachedNetNSPath, err := detachedNetNS(stateDir)
	if err != nil {
		return err
	}
	detachNetNSMode := detachedNetNSPath != ""
	log.L.Debugf("RootlessKit detach-netns mode: %v", detachNetNSMode)

	// FIXME: remove dependency on `nsenter` binary
	arg0, err := exec.LookPath("nsenter")
	if err != nil {
		return err
	}
	// -r/ (root dir) is intentionally omitted. nsenter would open the host
	// root fd before setns, then chroot to it after entering the mount
	// namespace, anchoring the process to host paths. In rootless mode,
	// host dirs owned by real uid 0 (e.g. /var/lib/containerd) are
	// inaccessible inside the user namespace and overlay mounts would
	// fail with EACCES.
	args := []string{arg0}

	// Only append wd if we do have a working dir
	// - https://github.com/rootless-containers/usernetes/pull/327
	// - https://github.com/containerd/nerdctl/issues/3328
	wd, err := os.Getwd()
	if err != nil {
		log.L.WithError(err).Warn("unable to determine working directory")
	} else {
		args = append(args, "-w"+wd)
		os.Setenv("PWD", wd)
	}

	args = append(args, "--preserve-credentials",
		"-m", "-U",
		"-t", strconv.Itoa(childPid),
		"-F", // no fork
	)
	if !detachNetNSMode {
		args = append(args, "-n")
	}
	args = append(args, os.Args...)
	log.L.Debugf("rootless parent main: executing %q with %v", arg0, args)

	// Env vars corresponds to RootlessKit spec:
	// https://github.com/rootless-containers/rootlesskit/tree/v0.13.1#environment-variables