From cda251026bd4f05b2367d59e09d33fcfdd367383 Mon Sep 17 00:00:00 2001 From: Adrien Langou Date: Wed, 14 Oct 2026 11:27:53 +0200 Subject: [PATCH 1/4] fix(vm): launch sandbox directly in guest root Signed-off-by: Adrien Langou --- .../scripts/openshell-vm-sandbox-init.sh | 16 ---------------- crates/openshell-driver-vm/src/rootfs.rs | 4 ++++ 2 files changed, 4 insertions(+), 16 deletions(-) diff --git a/crates/openshell-driver-vm/scripts/openshell-vm-sandbox-init.sh b/crates/openshell-driver-vm/scripts/openshell-vm-sandbox-init.sh index 7975f60cdb..23e21c62a0 100644 --- a/crates/openshell-driver-vm/scripts/openshell-vm-sandbox-init.sh +++ b/crates/openshell-driver-vm/scripts/openshell-vm-sandbox-init.sh @@ -205,27 +205,11 @@ exec_supervisor_in_newroot() { local chroot_bin local bootstrap="/.openshell-bootstrap" local supervisor="${bootstrap}/opt/openshell/bin/openshell-sandbox" - local loader - local lib_path for chroot_bin in /usr/sbin/chroot /usr/bin/chroot /sbin/chroot /bin/chroot; do [ -x "$chroot_bin" ] || continue if [ -x "/newroot${supervisor}" ]; then - for loader in \ - "${bootstrap}/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2" \ - "${bootstrap}/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2" \ - "${bootstrap}/lib64/ld-linux-x86-64.so.2" \ - "${bootstrap}/lib/ld-linux-x86-64.so.2" \ - "${bootstrap}/lib/aarch64-linux-gnu/ld-linux-aarch64.so.1" \ - "${bootstrap}/usr/lib/aarch64-linux-gnu/ld-linux-aarch64.so.1" \ - "${bootstrap}/lib/ld-linux-aarch64.so.1" \ - "${bootstrap}/lib64/ld-linux-aarch64.so.1"; do - if [ -x "/newroot${loader}" ]; then - lib_path="${bootstrap}/lib:${bootstrap}/lib64:${bootstrap}/usr/lib:${bootstrap}/usr/lib64:${bootstrap}/lib/aarch64-linux-gnu:${bootstrap}/lib/x86_64-linux-gnu:${bootstrap}/usr/lib/aarch64-linux-gnu:${bootstrap}/usr/lib/x86_64-linux-gnu" - exec "$chroot_bin" /newroot "$loader" --library-path "$lib_path" "$supervisor" "$@" - fi - done exec "$chroot_bin" /newroot "$supervisor" "$@" fi diff --git a/crates/openshell-driver-vm/src/rootfs.rs b/crates/openshell-driver-vm/src/rootfs.rs index cd4ee6307e..cceb0552f6 100644 --- a/crates/openshell-driver-vm/src/rootfs.rs +++ b/crates/openshell-driver-vm/src/rootfs.rs @@ -1291,6 +1291,10 @@ mod tests { ) ); assert!(init_script.contains("OPENSHELL_VM_SANDBOX_BOOTSTRAP")); + assert!(init_script.contains("exec \"$chroot_bin\" /newroot \"$supervisor\" \"$@\"")); + assert!(!init_script.contains("--library-path")); + assert!(!init_script.contains("\"$loader\"")); + assert!(!init_script.contains("ld-linux")); assert!(init_script.contains(" reconcile_sandbox_account\n setup_sandbox_workdir")); assert!( init_script From d5c483d1f8fb014d671f595d01684df9cdd4e9c1 Mon Sep 17 00:00:00 2001 From: Adrien Langou Date: Wed, 14 Oct 2026 12:08:47 +0200 Subject: [PATCH 2/4] test(vm): explain guest init launch assertions Signed-off-by: Adrien Langou --- crates/openshell-driver-vm/src/rootfs.rs | 2 ++ 1 file changed, 2 insertions(+) diff --git a/crates/openshell-driver-vm/src/rootfs.rs b/crates/openshell-driver-vm/src/rootfs.rs index cceb0552f6..c6b6821cfd 100644 --- a/crates/openshell-driver-vm/src/rootfs.rs +++ b/crates/openshell-driver-vm/src/rootfs.rs @@ -1291,6 +1291,8 @@ mod tests { ) ); assert!(init_script.contains("OPENSHELL_VM_SANDBOX_BOOTSTRAP")); + // The shell script is embedded verbatim in the guest rootfs, so these + // assertions pin its launch contract at the packaging boundary. assert!(init_script.contains("exec \"$chroot_bin\" /newroot \"$supervisor\" \"$@\"")); assert!(!init_script.contains("--library-path")); assert!(!init_script.contains("\"$loader\"")); From 37e568aed9470ffc2dc4966cc73cb64f7941b139 Mon Sep 17 00:00:00 2001 From: Adrien Langou Date: Wed, 14 Oct 2026 12:17:04 +0200 Subject: [PATCH 3/4] refactor(vm): inline guest bootstrap path Signed-off-by: Adrien Langou --- .../openshell-driver-vm/scripts/openshell-vm-sandbox-init.sh | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/crates/openshell-driver-vm/scripts/openshell-vm-sandbox-init.sh b/crates/openshell-driver-vm/scripts/openshell-vm-sandbox-init.sh index 23e21c62a0..5c4298b9ec 100644 --- a/crates/openshell-driver-vm/scripts/openshell-vm-sandbox-init.sh +++ b/crates/openshell-driver-vm/scripts/openshell-vm-sandbox-init.sh @@ -203,8 +203,7 @@ prepare_guest_image_rootfs() { exec_supervisor_in_newroot() { local chroot_bin - local bootstrap="/.openshell-bootstrap" - local supervisor="${bootstrap}/opt/openshell/bin/openshell-sandbox" + local supervisor="/.openshell-bootstrap/opt/openshell/bin/openshell-sandbox" for chroot_bin in /usr/sbin/chroot /usr/bin/chroot /sbin/chroot /bin/chroot; do [ -x "$chroot_bin" ] || continue From cfc81e567f8303cd8b5e62596190ba9c4bbd6e13 Mon Sep 17 00:00:00 2001 From: Adrien Langou Date: Wed, 14 Oct 2026 16:01:14 +0200 Subject: [PATCH 4/4] fix(vm): require bootstrap sandbox at guest startup Signed-off-by: Adrien Langou --- .../openshell-driver-vm/scripts/openshell-vm-sandbox-init.sh | 4 ---- 1 file changed, 4 deletions(-) diff --git a/crates/openshell-driver-vm/scripts/openshell-vm-sandbox-init.sh b/crates/openshell-driver-vm/scripts/openshell-vm-sandbox-init.sh index 5c4298b9ec..35cdbd8432 100644 --- a/crates/openshell-driver-vm/scripts/openshell-vm-sandbox-init.sh +++ b/crates/openshell-driver-vm/scripts/openshell-vm-sandbox-init.sh @@ -211,10 +211,6 @@ exec_supervisor_in_newroot() { if [ -x "/newroot${supervisor}" ]; then exec "$chroot_bin" /newroot "$supervisor" "$@" fi - - if [ -x /newroot/opt/openshell/bin/openshell-sandbox ]; then - exec "$chroot_bin" /newroot /opt/openshell/bin/openshell-sandbox "$@" - fi done ts "FATAL: unable to exec openshell-sandbox in guest rootfs"