github-mirrors/netris-nestri
1
0
Fork 0
mirror of https://github.com/nestriness/nestri.git synced 2026-09-23 11:08:18 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(build): the root really is read-only, and two comments that overclaimed

Browse Source 
Three places where build/ said something the tree does not do.

- fstab mounted `/` as `rw`. A box is started with `ro` on the kernel
  command line and `is_read_only: true` on the root device (every config in
  nesbox's tree agrees: examples/vm.json, test.json, run.local.json), so the
  virtio-blk device rejects writes whatever fstab asks for. `rw` here only
  made OpenRC's `root` service attempt a remount that has to fail. The
  Dockerfile already depended on the truth — it pre-creates /nestri/* at
  build time precisely because a runtime mkdir gets EROFS — so this makes
  fstab agree with the comment that was already right.

- build/README.md said nesbox's jail image "extracts Mesa and virglrenderer"
  from this base. It extracts only Mesa. virglrenderer is the host half of
  the native-context protocol and nesbox builds its own, patched, from
  nesbox/patches/; nothing in this image carries it at all.

- conf.d/nestri-user-env called the zink driver-forcing block "load-bearing"
  directly above three exports that are commented out, here and in the
  profile.d copy. Whether they should come back is a separate question; a
  comment insisting disabled lines are load-bearing tells the next reader
  the opposite of what the file does. The reasoning is kept, because it is
  still the reason to re-enable them, along with why both copies have to
  move together.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Wanjohi
2026-09-01 15:26:59 +03:00
parent 270304bca5
commit a76ca9ae81
3 changed files with 26 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
build/README.md
View File

@@ -55,12 +55,15 @@ Three things worth knowing about how this is put together:
source, not a dependency, not a directory that 'looked convenient'."* Both
are closed. `runtime_prod` from this Dockerfile — tagged
`ghcr.io/nestrilabs/nestri/base:latest` — is a complete, bootable, Steam-less guest image,
and also the shared foundation other builds start from: nesbox's jailer
image (see `nesbox/build/`) extracts Mesa and virglrenderer from it so the
guest and host sides of the virtio-gpu native-context protocol never drift
apart. Whatever layers Proton and the Steam client on top of it is a closed
build outside this repo, by design — not something this repo names, links
to, or depends on.
and also the shared foundation other builds start from: nesbox's jail image
(see `nesbox/build/`) extracts **Mesa** from it so the guest and host sides of
the virtio-gpu native-context protocol never drift apart. Only Mesa —
`virglrenderer` is the host half of that protocol and nesbox builds its own,
patched, from `nesbox/patches/`; nothing in this image carries it.
Whatever layers Proton and the Steam client on top of it is a closed build
outside this repo, by design — not something this repo names, links to, or
depends on.
## The nesinit gap