[PR #63] [MERGED] fix(mounts): make device & socket binds rprivate so they can't break the host (#53) #63

New issue

Closed

opened 2026-10-15 12:51:44 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 12:51:44 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/games-on-whales/LXC2Docker/pull/63
Author: @JBailes
Created: 6/5/2026
Status: ✅ Merged
Merged: 6/6/2026
Merged by: @JBailes

Base: main ← Head: fix/device-socket-mount-propagation

📝 Commits (1)

8846850 fix(mounts): make device & socket binds rprivate so they can't break the host

📊 Changes

2 files changed (+85 additions, -10 deletions)

View changed files

📝 internal/lxc/config.go (+25 -7)
📝 internal/lxc/config_test.go (+60 -3)

📄 Description

Problem

#54 set rprivate propagation on user bind mounts so a container that mounts its own devpts over a bind-mounted /dev could no longer replace the host's /dev/pts and /dev/ptmx — the failure behind "Wolf breaks Proxmox shell/ssh" (Server refused to allocate pty, broken web console).

That fix only covered the user-bind path. The daemon also emits binds without any propagation mode for:

Mapped devices — /dev/dri, /dev/uinput, /dev/uhid (both buildItems and the Proxmox buildPVEItems path)
Auto-mounted device dirs — /dev/input, derived from wildcard cgroup rules like c 13:* rmw
Shared socket directories — appendSocketMount / appendSocketDirMount (e.g. /run/user/wolf)

These all inherited the host's (shared) propagation and live under /dev and /run — exactly the subtrees Wolf touches — so the same host-breakage class stayed open on the CT path that actually runs on Proxmox.

Fix

Route every daemon-emitted bind through a single bindMountOpts() helper that appends the default rprivate, in both buildItems and buildPVEItems. Propagation governs only mount events, not devtmpfs node creation, so device access is unaffected.

Tests

Updated the three socket-mount tests to expect ,rprivate.
Added TestBuildItemsDeviceMountsArePrivate / TestBuildPVEItemsDeviceMountsArePrivate asserting device dir + node binds carry rprivate on both paths.
go build ./..., go vet, and full go test ./... pass.

Fixes #53

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/games-on-whales/LXC2Docker/pull/63 **Author:** [@JBailes](https://github.com/JBailes) **Created:** 6/5/2026 **Status:** ✅ Merged **Merged:** 6/6/2026 **Merged by:** [@JBailes](https://github.com/JBailes) **Base:** `main` ← **Head:** `fix/device-socket-mount-propagation` --- ### 📝 Commits (1) - [`8846850`](https://github.com/games-on-whales/LXC2Docker/commit/884685025cba70f87540e3df4b114866a464b8a1) fix(mounts): make device & socket binds rprivate so they can't break the host ### 📊 Changes **2 files changed** (+85 additions, -10 deletions) <details> <summary>View changed files</summary> 📝 `internal/lxc/config.go` (+25 -7) 📝 `internal/lxc/config_test.go` (+60 -3) </details> ### 📄 Description ## Problem #54 set `rprivate` propagation on **user** bind mounts so a container that mounts its own `devpts` over a bind-mounted `/dev` could no longer replace the host's `/dev/pts` and `/dev/ptmx` — the failure behind "Wolf breaks Proxmox shell/ssh" (`Server refused to allocate pty`, broken web console). That fix only covered the user-bind path. The daemon also emits binds without any propagation mode for: - **Mapped devices** — `/dev/dri`, `/dev/uinput`, `/dev/uhid` (both `buildItems` and the Proxmox `buildPVEItems` path) - **Auto-mounted device dirs** — `/dev/input`, derived from wildcard cgroup rules like `c 13:* rmw` - **Shared socket directories** — `appendSocketMount` / `appendSocketDirMount` (e.g. `/run/user/wolf`) These all inherited the host's (shared) propagation and live under `/dev` and `/run` — exactly the subtrees Wolf touches — so the same host-breakage class stayed open on the CT path that actually runs on Proxmox. ## Fix Route every daemon-emitted bind through a single `bindMountOpts()` helper that appends the default `rprivate`, in both `buildItems` and `buildPVEItems`. Propagation governs only mount events, not devtmpfs node creation, so device access is unaffected. ## Tests - Updated the three socket-mount tests to expect `,rprivate`. - Added `TestBuildItemsDeviceMountsArePrivate` / `TestBuildPVEItemsDeviceMountsArePrivate` asserting device dir + node binds carry `rprivate` on both paths. - `go build ./...`, `go vet`, and full `go test ./...` pass. Fixes #53 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-15 12:51:44 +00:00