Function prepareRootfs

libcontainer/rootfs_linux.go:170–273

prepareRootfs sets up the devices, mount points, and filesystems for use inside a new mount namespace. It doesn't set anything as ro. You must call finalizeRootfs after this function to finish setting up the rootfs.

(pipe *syncSocket, iConfig *initConfig)

// inside a new mount namespace. It doesn't set anything as ro. You must call
// finalizeRootfs after this function to finish setting up the rootfs.
func prepareRootfs(pipe *syncSocket, iConfig *initConfig) (err error) {
	config := iConfig.Config
	if err := prepareRoot(config); err != nil {
		return fmt.Errorf("error preparing rootfs: %w", err)
	}

	// Pre-open rootfs. NOTE that if we need to re-enable support for mounting
	// on top of container root (see issue 5070), we will need to reopen rootFd
	// after such mounts.
	rootFd, err := os.OpenFile(config.Rootfs, unix.O_DIRECTORY|unix.O_CLOEXEC|unix.O_PATH, 0)
	if err != nil {
		return fmt.Errorf("open rootfs handle: %w", err)
	}
	defer rootFd.Close()

	mountConfig := &mountConfig{
		root:            rootFd,
		label:           config.MountLabel,
		cgroup2Path:     iConfig.Cgroup2Path,
		rootlessCgroups: config.RootlessCgroups,
		cgroupns:        config.Namespaces.Contains(configs.NEWCGROUP),
	}
	for _, m := range config.Mounts {
		if err := setupAndMountToRootfs(pipe, config, mountConfig, m); err != nil {
			return err
		}
	}

	setupDev := needsSetupDev(config)
	if setupDev {
		if err := doSetupDev(rootFd, config); err != nil {
			return fmt.Errorf("configuring container /dev: %w", err)
		}
	}

	// Signal the parent to run the pre-start hooks.
	// The hooks are run after the mounts are setup, but before we switch to the new
	// root, so that the old root is still available in the hooks for any mount
	// manipulations.
	// Note that iConfig.Cwd is not guaranteed to exist here.
	if err := syncParentHooks(pipe); err != nil {
		return err
	}

	// The reason these operations are done here rather than in finalizeRootfs
	// is because the console-handling code gets quite sticky if we have to set
	// up the console before doing the pivot_root(2). This is because the
	// Console API has to also work with the ExecIn case, which means that the
	// API must be able to deal with being inside as well as outside the
	// container. It's just cleaner to do this here (at the expense of the
	// operation not being perfectly split).

	if err := unix.Fchdir(int(rootFd.Fd())); err != nil {
		return &os.PathError{Op: "chdir", Path: config.Rootfs, Err: err}
	}

	if s := iConfig.SpecState; s != nil {
		s.Pid = unix.Getpid()