From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: passt.top; dkim=pass (2048-bit key; secure) header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.a=rsa-sha256 header.s=202606 header.b=mUznIW4Q; dkim-atps=neutral Received: from mail.ozlabs.org (mail.ozlabs.org [IPv6:2404:9400:2221:ea00::3]) by passt.top (Postfix) with ESMTPS id 7F3485A0262 for ; Thu, 23 Jul 2026 05:37:07 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202606; t=1784777824; bh=Dt/WUeHtjCTNIsr6AMC0UAXg4XBeKtW9Yp9N2gTDS/8=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=mUznIW4QxWFnj2d/bgWucFdvVRkEX1umjG70pkIwDbQ8hr8VwTcfclxI87nSygHmp U5NnMI48Hn5pYlhcQLTP2BAEm3yBrNI6CE0MuSJeftxB8mwvjx+IBlbABVLTGE5JnI BwwMjAqQm0zTVrZdivt/hJB2vFbCiUPHg+viYu7r9Q+qF05lJ/kWclHAOt9eQsy/Ld 6rbKImZNoEUV2GcspIO/RBN3em9NsuaFKnQVT7R9I+iDH6e+HT6bY8pitE+o1sAv4a 44FAh+M0t2vqdcLs5yG9BnxnmqzsTpmV8LiF5RMdECcEwJd7lQgdUoLfj9VM84Hkd9 yK9yajw0BExTA== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4h5GyS24GHz4wCC; Thu, 23 Jul 2026 13:37:04 +1000 (AEST) Date: Thu, 23 Jul 2026 10:16:56 +1000 From: David Gibson To: Stefano Brivio Subject: Re: [PATCH v3] feat: Add cli option '--pass-fds' for pasta mode. Message-ID: References: <20260719200300.201469-1-rlawrence@tamu.edu> <20260722004525.3371f1ae@elisabeth> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="oYyoQFsCCCxtcF+G" Content-Disposition: inline In-Reply-To: <20260722004525.3371f1ae@elisabeth> Message-ID-Hash: KDXDCAOXMOTK5UWGRFTLXVDUSSSU2HUI X-Message-ID-Hash: KDXDCAOXMOTK5UWGRFTLXVDUSSSU2HUI X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: "Lawrence, Richard E" , "passt-dev@passt.top" , "jbash@jbash.com" X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --oYyoQFsCCCxtcF+G Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, Jul 22, 2026 at 12:45:25AM +0200, Stefano Brivio wrote: > Richard, I haven't found the time to review your patch in detail yet > and the whole problem description, just a few notes so far: >=20 > On Tue, 21 Jul 2026 04:44:05 +0000 > "Lawrence, Richard E" wrote: >=20 > > [...] > > > > I tried executing bubblewrap within pasta. And it's so close to being w= hat I wanted! It's a simple one-liner and for some reason I don't understan= d, avoids the issue with the nested namespace. But it still isn't what I wa= nted, because another thing I like to do is deliver bwrap's many many args = to it via a file descriptor (--args FD) to simplify the process name for ps= and avoid leaking private information to anyone else running on the same n= ode. But since pasta couldn't pass FD's through to bubblewrap, so now I hav= e to wrap my bubblewrap command inside some other bespoke script whose job = is to open a temporary file I am serving somewhere, which just becomes anot= her opportunity to leak my private information. >=20 > By the way, you don't seem to be the only one using a workaround like > this, see also: >=20 > https://github.com/reubenfirmin/bubblewrap-tui#why-pasta >=20 > > Sidebar: if you think about it, the only reason the nsenter strategy ca= n even be considered a "workaround" for pasta not having --pass-fd is that = nsenter does have the feature to pass FD's through (in fact, it is the defa= ult). That's not a good look for pasta. > >=20 > > Sidebar: Yes, it can be said that my problem would be solved on the bub= blewrap side if only bubblewrap could join an existing network namespace. I= also submitted the PR to create that feature. >=20 > Ah, interesting, thanks for doing that. That should hopefully solve > this specific problem. At the same time: >=20 > > Nevertheless, I feel strongly that passing FD's has other plausible con= sumers besides specifically bubblewrap. >=20 > ...this sounds quite likely as well, given it's already two people > including you requesting this feature, and the other example of a > workaround, even though it's a workaround for what I consider a missing > feature in bubblewrap, because it should really have a proper > integration (just like Podman, Docker / rootlesskit, libvirt, libkrun, > etc. have). See also: >=20 > https://bugs.passt.top/show_bug.cgi?id=3D214 >=20 > for another consequence of a missing integration. >=20 > But given the likelihood of that, I'm also rather convinced that this > option might be useful for this case or for other cases. >=20 > I just think that we should implement it in the simplest possible way, > and if spawning the command before closing file descriptors (which > would remain open in the child process only) works as well, I would > suggest to go for that (sorry it didn't occur to me as I had a look at > v1). Right. Note that as well as being (I think) a simpler implementation, that will be a better UX: you don't need to enumerate all the fds and add an option for them. Plus I think it makes more logical sense - our self-isolation steps are to isolate, well, ourselves. They're not really intended for the spawned commaned. --=20 David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson --oYyoQFsCCCxtcF+G Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEO+dNsU4E3yXUXRK2zQJF27ox2GcFAmphXXEACgkQzQJF27ox 2GcnNA//Vlug+FX6X5iNxjFG+rzmI03F5RG+FFRA94TF/rBT1TQhtyK1eLEhR5CT dz3AJ+SmqcQD5dLj6OBsNfcMkUJe8lvoAtBC7lIl6W9deQT9hpHKc+nfEvWLah4K Itl/jlzp+Ycb73IDFWd2LH+KotfBFN1DEajNop0Fy8QDI6tLwMFWiN6nYu+Q2xZF D5LKmekZBa4r/gyiDFW84TR0fFFSG/5E4bmwPfCBoudARZHJNbFDMNeGdUx4djfD WGt0z353wK95RBXZeHdLpnLF5Q3fdeW73Jl/1Bao6Tb4z5/DBKcbfGTKnCIMMHSL TjSx/lqSKpTw5aqYMG7gHo73tG1EIBeGBjUI0b1ePfx4KI3xjFkg8Q5taVQ5HAf7 IKrWJZC8Twoj+KsWK2bzXZ4RBm+PgBWefI22uMf5B1sSs2cA0IYBeKm5/n2V6aq4 l5yxCgUtww5yggwl/RIiO+t2K6+duzu1QX3Wvr1hnt3wikePN0ML8DrI23cDz7OA m3jcSV1ucuP0fn17SxuGqKEx0kVxLi18NW6sXDRZUGO196RIW9jRoY30SCgE0FcS QEoFkjD6M57rxRJt7Hka3/N38Na5cMYeUS1G7mZewS6Bm7PrtaurmbrlHt74s15a iS6nEB9f06nNLtEpiPAW8+H9ZkN04lqorK1HgNuzRGBOpXu11j4= =iyvz -----END PGP SIGNATURE----- --oYyoQFsCCCxtcF+G--