mirror of
https://github.com/nestriness/nestri.git
synced 2026-05-01 10:53:08 +03:00
94 lines
3.5 KiB
Bash
94 lines
3.5 KiB
Bash
#!/bin/bash
|
|
set -e
|
|
|
|
# ============================================================
|
|
# 1. Save files from old /run
|
|
# ============================================================
|
|
_resolv=""
|
|
_localtime=""
|
|
[ -f /run/nestri/resolv.conf ] && _resolv=$(cat /run/nestri/resolv.conf)
|
|
[ -f /run/nestri/localtime ] && _localtime=$(base64 /run/nestri/localtime 2>/dev/null) || true
|
|
|
|
# ============================================================
|
|
# 2. Fresh tmpfs on /run
|
|
# ============================================================
|
|
mount -t tmpfs tmpfs /run -o nosuid,nodev,strictatime
|
|
|
|
# ============================================================
|
|
# 3. Restore saved files
|
|
# ============================================================
|
|
if [ -n "$_resolv" ]; then
|
|
echo "$_resolv" > /run/resolv.conf
|
|
echo "$_resolv" > /etc/resolv.conf 2>/dev/null || true
|
|
fi
|
|
if [ -n "$_localtime" ]; then
|
|
echo "$_localtime" | base64 -d > /run/localtime
|
|
echo "$_localtime" | base64 -d > /etc/localtime 2>/dev/null || true
|
|
fi
|
|
|
|
# ============================================================
|
|
# 4. Machine ID
|
|
# ============================================================
|
|
# FIXME(wanjohiryan): Use the same machine-id as the host? For Steam, i believe it does check machine id and stuff like that for SteamGuard
|
|
if [ ! -s /etc/machine-id ]; then
|
|
head -c 16 /dev/urandom | od -A n -t x1 | tr -d ' \n' > /etc/machine-id
|
|
echo "" >> /etc/machine-id
|
|
fi
|
|
|
|
# ============================================================
|
|
# 5. Journald
|
|
# ============================================================
|
|
mkdir -p /run/systemd/journal /run/log/journal
|
|
|
|
mkdir -p /etc/systemd/system/systemd-journald.service.d
|
|
cat > /etc/systemd/system/systemd-journald.service.d/override.conf << 'EOF'
|
|
[Service]
|
|
RuntimeDirectory=
|
|
LogsDirectory=
|
|
StateDirectory=
|
|
ExecStartPre=/bin/mkdir -p /run/systemd/journal /run/log/journal
|
|
EOF
|
|
|
|
# ============================================================
|
|
# 6. Hide container FILE markers (ro rootfs)
|
|
# But DO NOT strip the `container` env var!
|
|
# systemd needs it for exit.target (clean shutdown).
|
|
# ============================================================
|
|
for marker in /.dockerenv /run/.containerenv; do
|
|
if [ -e "$marker" ]; then
|
|
mount --bind /dev/null "$marker" 2>/dev/null || true
|
|
fi
|
|
done
|
|
|
|
# ============================================================
|
|
# 8. Isolate X11 socket directory
|
|
# ============================================================
|
|
if [ -d /tmp/.X11-unix ]; then
|
|
mount -t tmpfs tmpfs /tmp/.X11-unix -o noexec,nosuid,relatime
|
|
fi
|
|
|
|
# ============================================================
|
|
# 9. Remount /dev/shm as virtiofs with DAX
|
|
# (required for cross-domain shared memory, DRI3 fences)
|
|
# ============================================================
|
|
umount /dev/shm
|
|
mount -t virtiofs devshm /dev/shm -o noexec,nosuid,dax
|
|
|
|
# ============================================================
|
|
# 10. Boot time offset
|
|
# ============================================================
|
|
if [ -n "$BOOT_TIME_OFFSET" ]; then
|
|
if unshare --time true 2>/dev/null; then
|
|
exec unshare --time -- bash -c '
|
|
echo "monotonic '"$BOOT_TIME_OFFSET"'" > /proc/self/timens_offsets 2>/dev/null
|
|
echo "boottime '"$BOOT_TIME_OFFSET"'" >> /proc/self/timens_offsets 2>/dev/null
|
|
exec "$@"
|
|
' -- "$@"
|
|
fi
|
|
fi
|
|
|
|
# ============================================================
|
|
# 11. Hand off to systemd
|
|
# ============================================================
|
|
exec "$@"
|