mirror of
https://github.com/nestriness/nestri.git
synced 2026-09-19 17:25:19 +03:00
a76ca9ae81
Three places where build/ said something the tree does not do. - fstab mounted `/` as `rw`. A box is started with `ro` on the kernel command line and `is_read_only: true` on the root device (every config in nesbox's tree agrees: examples/vm.json, test.json, run.local.json), so the virtio-blk device rejects writes whatever fstab asks for. `rw` here only made OpenRC's `root` service attempt a remount that has to fail. The Dockerfile already depended on the truth — it pre-creates /nestri/* at build time precisely because a runtime mkdir gets EROFS — so this makes fstab agree with the comment that was already right. - build/README.md said nesbox's jail image "extracts Mesa and virglrenderer" from this base. It extracts only Mesa. virglrenderer is the host half of the native-context protocol and nesbox builds its own, patched, from nesbox/patches/; nothing in this image carries it at all. - conf.d/nestri-user-env called the zink driver-forcing block "load-bearing" directly above three exports that are commented out, here and in the profile.d copy. Whether they should come back is a separate question; a comment insisting disabled lines are load-bearing tells the next reader the opposite of what the file does. The reasoning is kept, because it is still the reason to re-enable them, along with why both copies have to move together. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
36 lines
2.1 KiB
Plaintext
36 lines
2.1 KiB
Plaintext
# `ro`, matching how a box is actually started: nesbox passes `ro` on the
|
|
# kernel command line and marks the root device `is_read_only: true` (see
|
|
# nesbox's examples/vm.json), so the virtio-blk device refuses writes at the
|
|
# device level. Saying `rw` here does not make it writable — it only asks
|
|
# OpenRC's `root` service to attempt a remount that the device must reject.
|
|
# Everything a running box writes to is a tmpfs or a share below.
|
|
/dev/vda / ext4 ro,relatime 0 1
|
|
devtmpfs /dev devtmpfs rw,nosuid 0 0
|
|
proc /proc proc rw,nosuid,nodev,noexec 0 0
|
|
sysfs /sys sysfs rw,nosuid,nodev,noexec 0 0
|
|
tmpfs /tmp tmpfs rw,nosuid,nodev,size=64M 0 0
|
|
tmpfs /run tmpfs rw,nosuid,nodev,size=32M,mode=0755 0 0
|
|
tmpfs /var/log tmpfs rw,nosuid,nodev,size=16M 0 0
|
|
# POSIX shared memory. devtmpfs does not provide it and nothing else mounts it,
|
|
# so without this entry /dev/shm does not exist at all and `shm_open` fails.
|
|
#
|
|
# PipeWire itself gets by: it allocates buffers with memfd_create and only
|
|
# falls back to /dev/shm. Kept as a precaution for anything else that uses
|
|
# POSIX shm/semaphores directly — Proton is the known example, and it is not
|
|
# part of this image yet (see build/README.md), but a failure here is silent
|
|
# rather than fatal, so it costs nothing to have ready.
|
|
#
|
|
# `nosuid,nodev` and a size cap because everything a game can write to should
|
|
# have both.
|
|
tmpfs /dev/shm tmpfs rw,nosuid,nodev,size=256M 0 0
|
|
# The guest's logs, on a host directory that outlives the VM.
|
|
#
|
|
# Here rather than mounted by a service, because the failures worth reading
|
|
# are the ones that happen *before* anything else has mounted something — a
|
|
# log directory that appears only after a successful start cannot record an
|
|
# unsuccessful one. The tag is fixed by nessh, so plain fstab works.
|
|
#
|
|
# `nofail` because a VM started without the share still has to boot: that is
|
|
# how somebody gets a shell to find out why it has no share.
|
|
logs /nestri/logs virtiofs rw,nofail 0 0
|