[PR #62] [MERGED] fix(mounts): don't host-back XDG_RUNTIME_DIR when a sibling populates it #62

New issue

Closed

opened 2026-10-15 12:51:43 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 12:51:43 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/games-on-whales/LXC2Docker/pull/62
Author: @JBailes
Created: 6/5/2026
Status: ✅ Merged
Merged: 6/5/2026
Merged by: @JBailes

Base: main ← Head: fix/runtime-dir-host-back-shadows-siblings

📝 Commits (1)

ddefaa9 fix(mounts): don't host-back XDG_RUNTIME_DIR when a sibling populates it

📊 Changes

4 files changed (+91 additions, -4 deletions)

View changed files

📝 internal/api/containers.go (+9 -0)
📝 internal/api/sibling_mount_test.go (+11 -0)
📝 internal/lxc/manager.go (+36 -4)
📝 internal/lxc/manager_test.go (+35 -0)

📄 Description

Follow-up to #59. On runtimes where Wolf cannot introspect its own container (e.g. the SmoothNAS LXC backend, which has no Docker container API for Wolf itself), Wolf passes its host-path XDG_RUNTIME_DIR to siblings and mounts its wayland/pulse sockets as child paths ($XDG_RUNTIME_DIR/<socket>, see sessions/common.cpp), not as a single whole-dir bind.

ensureRuntimeDirMount only skipped host-backing when an existing mount was at or above XDG_RUNTIME_DIR, so it still fired here and appended an empty host-backed dir over those child socket mounts — shadowing them. The app container then dies with Could not connect to remote display / Cant connect to a Wayland display. (Confirmed on the appliance: one empty state/runtime/<id>/ host-back dir per app container, and Wolf-UI/Steam failing to reach the display.)

Changes

ensureRuntimeDirMount: also suppress host-backing when an existing mount is a child of XDG_RUNTIME_DIR — a sibling already provides the shared content, so host-backing would only shadow it. The PulseAudio-sibling case from #59 (no child mounts; owner creates the dir at runtime) is unchanged.
prepareRootfs: create XDG_RUNTIME_DIR with a traversable parent chain (0755 parents, 0700 leaf) instead of os.MkdirAll(dir, 0o700), which made every intermediate of a deep runtime dir 0700 root and blocked the non-root run-user (gows retro) from traversing to the socket.

Tests added for both: the child-mount suppression case and the traversable-parents/0700-leaf invariant. Existing #59 tests still pass.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/games-on-whales/LXC2Docker/pull/62 **Author:** [@JBailes](https://github.com/JBailes) **Created:** 6/5/2026 **Status:** ✅ Merged **Merged:** 6/5/2026 **Merged by:** [@JBailes](https://github.com/JBailes) **Base:** `main` ← **Head:** `fix/runtime-dir-host-back-shadows-siblings` --- ### 📝 Commits (1) - [`ddefaa9`](https://github.com/games-on-whales/LXC2Docker/commit/ddefaa9ca5f713d3b1ece68ea41a2c80d5812f20) fix(mounts): don't host-back XDG_RUNTIME_DIR when a sibling populates it ### 📊 Changes **4 files changed** (+91 additions, -4 deletions) <details> <summary>View changed files</summary> 📝 `internal/api/containers.go` (+9 -0) 📝 `internal/api/sibling_mount_test.go` (+11 -0) 📝 `internal/lxc/manager.go` (+36 -4) 📝 `internal/lxc/manager_test.go` (+35 -0) </details> ### 📄 Description Follow-up to #59. On runtimes where Wolf cannot introspect its own container (e.g. the SmoothNAS LXC backend, which has no Docker container API for Wolf itself), Wolf passes its **host-path** `XDG_RUNTIME_DIR` to siblings and mounts its wayland/pulse sockets as **child** paths (`$XDG_RUNTIME_DIR/<socket>`, see `sessions/common.cpp`), not as a single whole-dir bind. `ensureRuntimeDirMount` only skipped host-backing when an existing mount was **at or above** `XDG_RUNTIME_DIR`, so it still fired here and appended an empty host-backed dir **over** those child socket mounts — shadowing them. The app container then dies with `Could not connect to remote display` / `Cant connect to a Wayland display`. (Confirmed on the appliance: one empty `state/runtime/<id>/` host-back dir per app container, and Wolf-UI/Steam failing to reach the display.) ## Changes 1. **`ensureRuntimeDirMount`**: also suppress host-backing when an existing mount is a *child* of `XDG_RUNTIME_DIR` — a sibling already provides the shared content, so host-backing would only shadow it. The PulseAudio-sibling case from #59 (no child mounts; owner creates the dir at runtime) is unchanged. 2. **`prepareRootfs`**: create `XDG_RUNTIME_DIR` with a traversable parent chain (0755 parents, 0700 leaf) instead of `os.MkdirAll(dir, 0o700)`, which made every intermediate of a *deep* runtime dir `0700 root` and blocked the non-root run-user (gows `retro`) from traversing to the socket. Tests added for both: the child-mount suppression case and the traversable-parents/0700-leaf invariant. Existing #59 tests still pass. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-15 12:51:43 +00:00

closed this issue
added the
pull-request
label

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

games-on-whales/LXC2Docker#62

No description provided.

Rows
Columns