release: 0.2.2

Unfortunately removal of internal/hlog brought about some changes that breaks API. This will likely be the last 0.2.x release.

Signed-off-by: Ophestra <cat@gensokyo.uk>

.gitea/workflows/test.yml

@@ -73,20 +73,20 @@ jobs:
           path: result/*
           retention-days: 1
 
-  planterette:
-    name: Planterette
+  hpkg:
+    name: Hpkg
     runs-on: nix
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
       - name: Run NixOS test
-        run: nix build --out-link "result" --print-out-paths --print-build-logs .#checks.x86_64-linux.planterette
+        run: nix build --out-link "result" --print-out-paths --print-build-logs .#checks.x86_64-linux.hpkg
 
       - name: Upload test output
         uses: actions/upload-artifact@v3
         with:
-          name: "planterette-vm-output"
+          name: "hpkg-vm-output"
           path: result/*
           retention-days: 1
 
@@ -97,7 +97,7 @@ jobs:
       - race
       - sandbox
       - sandbox-race
-      - planterette
+      - hpkg
     runs-on: nix
     steps:
       - name: Checkout

.github/workflows/README

@@ -1 +1,5 @@
+DO NOT ADD NEW ACTIONS HERE
+
 This port is solely for releasing to the github mirror and serves no purpose during development.
+All development happens at https://git.gensokyo.uk/security/hakurei. If you wish to contribute,
+request for an account on git.gensokyo.uk.

.gitignore

@@ -30,3 +30,6 @@ go.work.sum
 
 # release
 /dist/hakurei-*
+
+# interactive nixos vm
+nixos.qcow2

README.md

@@ -16,7 +16,8 @@
 </p>
 
 Hakurei is a tool for running sandboxed graphical applications as dedicated subordinate users on the Linux kernel.
-It also implements [planterette (WIP)](cmd/planterette), a self-contained Android-like package manager with modern security features.
+It implements the application container of [planterette (WIP)](https://git.gensokyo.uk/security/planterette),
+a self-contained Android-like package manager with modern security features.
 
 ## NixOS Module usage
 

cmd/hakurei/command.go

@@ -6,14 +6,13 @@ import (
 	"io"
 	"log"
 	"os"
-	"os/signal"
 	"os/user"
 	"strconv"
 	"sync"
-	"syscall"
 	"time"
 
 	"hakurei.app/command"
+	"hakurei.app/container"
 	"hakurei.app/hst"
 	"hakurei.app/internal"
 	"hakurei.app/internal/app"
@@ -23,7 +22,7 @@ import (
 	"hakurei.app/system/dbus"
 )
 
-func buildCommand(out io.Writer) command.Command {
+func buildCommand(ctx context.Context, out io.Writer) command.Command {
 	var (
 		flagVerbose bool
 		flagJSON    bool
@@ -43,35 +42,35 @@ func buildCommand(out io.Writer) command.Command {
 		config := tryPath(args[0])
 		config.Args = append(config.Args, args[1:]...)
 
-		runApp(config)
+		app.Main(ctx, config)
 		panic("unreachable")
 	})
 
 	{
 		var (
-			dbusConfigSession string
-			dbusConfigSystem  string
-			mpris             bool
-			dbusVerbose       bool
+			flagDBusConfigSession string
+			flagDBusConfigSystem  string
+			flagDBusMpris         bool
+			flagDBusVerbose       bool
 
-			fid      string
-			aid      int
-			groups   command.RepeatableFlag
-			homeDir  string
-			userName string
+			flagID       string
+			flagIdentity int
+			flagGroups   command.RepeatableFlag
+			flagHomeDir  string
+			flagUserName string
 
-			wayland, x11, dBus, pulse bool
+			flagWayland, flagX11, flagDBus, flagPulse bool
 		)
 
 		c.NewCommand("run", "Configure and start a permissive default sandbox", func(args []string) error {
 			// initialise config from flags
 			config := &hst.Config{
-				ID:   fid,
+				ID:   flagID,
 				Args: args,
 			}
 
-			if aid < 0 || aid > 9999 {
-				log.Fatalf("aid %d out of range", aid)
+			if flagIdentity < 0 || flagIdentity > 9999 {
+				log.Fatalf("identity %d out of range", flagIdentity)
 			}
 
 			// resolve home/username from os when flag is unset
@@ -79,14 +78,7 @@ func buildCommand(out io.Writer) command.Command {
 				passwd     *user.User
 				passwdOnce sync.Once
 				passwdFunc = func() {
-					var us string
-					if uid, err := std.Uid(aid); err != nil {
-						hlog.PrintBaseError(err, "cannot obtain uid from setuid wrapper:")
-						os.Exit(1)
-					} else {
-						us = strconv.Itoa(uid)
-					}
-
+					us := strconv.Itoa(app.HsuUid(new(app.Hsu).MustID(), flagIdentity))
 					if u, err := user.LookupId(us); err != nil {
 						hlog.Verbosef("cannot look up uid %s", us)
 						passwd = &user.User{
@@ -94,7 +86,7 @@ func buildCommand(out io.Writer) command.Command {
 							Gid:      us,
 							Username: "chronos",
 							Name:     "Hakurei Permissive Default",
-							HomeDir:  "/var/empty",
+							HomeDir:  container.FHSVarEmpty,
 						}
 					} else {
 						passwd = u
@@ -102,119 +94,136 @@ func buildCommand(out io.Writer) command.Command {
 				}
 			)
 
-			if homeDir == "os" {
+			if flagHomeDir == "os" {
 				passwdOnce.Do(passwdFunc)
-				homeDir = passwd.HomeDir
+				flagHomeDir = passwd.HomeDir
 			}
 
-			if userName == "chronos" {
+			if flagUserName == "chronos" {
 				passwdOnce.Do(passwdFunc)
-				userName = passwd.Username
+				flagUserName = passwd.Username
 			}
 
-			config.Identity = aid
-			config.Groups = groups
-			config.Data = homeDir
-			config.Username = userName
+			config.Identity = flagIdentity
+			config.Groups = flagGroups
+			config.Username = flagUserName
 
-			if wayland {
-				config.Enablements |= system.EWayland
+			if a, err := container.NewAbs(flagHomeDir); err != nil {
+				log.Fatal(err.Error())
+				return err
+			} else {
+				config.Home = a
 			}
-			if x11 {
-				config.Enablements |= system.EX11
+
+			var e system.Enablement
+			if flagWayland {
+				e |= system.EWayland
 			}
-			if dBus {
-				config.Enablements |= system.EDBus
+			if flagX11 {
+				e |= system.EX11
 			}
-			if pulse {
-				config.Enablements |= system.EPulse
+			if flagDBus {
+				e |= system.EDBus
 			}
+			if flagPulse {
+				e |= system.EPulse
+			}
+			config.Enablements = hst.NewEnablements(e)
 
 			// parse D-Bus config file from flags if applicable
-			if dBus {
-				if dbusConfigSession == "builtin" {
-					config.SessionBus = dbus.NewConfig(fid, true, mpris)
+			if flagDBus {
+				if flagDBusConfigSession == "builtin" {
+					config.SessionBus = dbus.NewConfig(flagID, true, flagDBusMpris)
 				} else {
-					if conf, err := dbus.NewConfigFromFile(dbusConfigSession); err != nil {
-						log.Fatalf("cannot load session bus proxy config from %q: %s", dbusConfigSession, err)
+					if conf, err := dbus.NewConfigFromFile(flagDBusConfigSession); err != nil {
+						log.Fatalf("cannot load session bus proxy config from %q: %s", flagDBusConfigSession, err)
 					} else {
 						config.SessionBus = conf
 					}
 				}
 
 				// system bus proxy is optional
-				if dbusConfigSystem != "nil" {
-					if conf, err := dbus.NewConfigFromFile(dbusConfigSystem); err != nil {
-						log.Fatalf("cannot load system bus proxy config from %q: %s", dbusConfigSystem, err)
+				if flagDBusConfigSystem != "nil" {
+					if conf, err := dbus.NewConfigFromFile(flagDBusConfigSystem); err != nil {
+						log.Fatalf("cannot load system bus proxy config from %q: %s", flagDBusConfigSystem, err)
 					} else {
 						config.SystemBus = conf
 					}
 				}
 
 				// override log from configuration
-				if dbusVerbose {
-					config.SessionBus.Log = true
-					config.SystemBus.Log = true
+				if flagDBusVerbose {
+					if config.SessionBus != nil {
+						config.SessionBus.Log = true
+					}
+					if config.SystemBus != nil {
+						config.SystemBus.Log = true
+					}
 				}
 			}
 
-			// invoke app
-			runApp(config)
+			app.Main(ctx, config)
 			panic("unreachable")
 		}).
-			Flag(&dbusConfigSession, "dbus-config", command.StringFlag("builtin"),
+			Flag(&flagDBusConfigSession, "dbus-config", command.StringFlag("builtin"),
 				"Path to session bus proxy config file, or \"builtin\" for defaults").
-			Flag(&dbusConfigSystem, "dbus-system", command.StringFlag("nil"),
+			Flag(&flagDBusConfigSystem, "dbus-system", command.StringFlag("nil"),
 				"Path to system bus proxy config file, or \"nil\" to disable").
-			Flag(&mpris, "mpris", command.BoolFlag(false),
+			Flag(&flagDBusMpris, "mpris", command.BoolFlag(false),
 				"Allow owning MPRIS D-Bus path, has no effect if custom config is available").
-			Flag(&dbusVerbose, "dbus-log", command.BoolFlag(false),
+			Flag(&flagDBusVerbose, "dbus-log", command.BoolFlag(false),
 				"Force buffered logging in the D-Bus proxy").
-			Flag(&fid, "id", command.StringFlag(""),
+			Flag(&flagID, "id", command.StringFlag(""),
 				"Reverse-DNS style Application identifier, leave empty to inherit instance identifier").
-			Flag(&aid, "a", command.IntFlag(0),
+			Flag(&flagIdentity, "a", command.IntFlag(0),
 				"Application identity").
-			Flag(nil, "g", &groups,
+			Flag(nil, "g", &flagGroups,
 				"Groups inherited by all container processes").
-			Flag(&homeDir, "d", command.StringFlag("os"),
+			Flag(&flagHomeDir, "d", command.StringFlag("os"),
 				"Container home directory").
-			Flag(&userName, "u", command.StringFlag("chronos"),
+			Flag(&flagUserName, "u", command.StringFlag("chronos"),
 				"Passwd user name within sandbox").
-			Flag(&wayland, "wayland", command.BoolFlag(false),
+			Flag(&flagWayland, "wayland", command.BoolFlag(false),
 				"Enable connection to Wayland via security-context-v1").
-			Flag(&x11, "X", command.BoolFlag(false),
+			Flag(&flagX11, "X", command.BoolFlag(false),
 				"Enable direct connection to X11").
-			Flag(&dBus, "dbus", command.BoolFlag(false),
+			Flag(&flagDBus, "dbus", command.BoolFlag(false),
 				"Enable proxied connection to D-Bus").
-			Flag(&pulse, "pulse", command.BoolFlag(false),
+			Flag(&flagPulse, "pulse", command.BoolFlag(false),
 				"Enable direct connection to PulseAudio")
 	}
 
-	var showFlagShort bool
-	c.NewCommand("show", "Show live or local app configuration", func(args []string) error {
-		switch len(args) {
-		case 0: // system
-			printShowSystem(os.Stdout, showFlagShort, flagJSON)
+	{
+		var flagShort bool
+		c.NewCommand("show", "Show live or local app configuration", func(args []string) error {
+			switch len(args) {
+			case 0: // system
+				printShowSystem(os.Stdout, flagShort, flagJSON)
 
-		case 1: // instance
-			name := args[0]
-			config, entry := tryShort(name)
-			if config == nil {
-				config = tryPath(name)
+			case 1: // instance
+				name := args[0]
+				config, entry := tryShort(name)
+				if config == nil {
+					config = tryPath(name)
+				}
+				printShowInstance(os.Stdout, time.Now().UTC(), entry, config, flagShort, flagJSON)
+
+			default:
+				log.Fatal("show requires 1 argument")
 			}
-			printShowInstance(os.Stdout, time.Now().UTC(), entry, config, showFlagShort, flagJSON)
+			return errSuccess
+		}).Flag(&flagShort, "short", command.BoolFlag(false), "Omit filesystem information")
+	}
 
-		default:
-			log.Fatal("show requires 1 argument")
-		}
-		return errSuccess
-	}).Flag(&showFlagShort, "short", command.BoolFlag(false), "Omit filesystem information")
-
-	var psFlagShort bool
-	c.NewCommand("ps", "List active instances", func(args []string) error {
-		printPs(os.Stdout, time.Now().UTC(), state.NewMulti(std.Paths().RunDirPath), psFlagShort, flagJSON)
-		return errSuccess
-	}).Flag(&psFlagShort, "short", command.BoolFlag(false), "Print instance id")
+	{
+		var flagShort bool
+		c.NewCommand("ps", "List active instances", func(args []string) error {
+			var sc hst.Paths
+			app.CopyPaths(&sc, new(app.Hsu).MustID())
+			printPs(os.Stdout, time.Now().UTC(), state.NewMulti(sc.RunDirPath.String()), flagShort, flagJSON)
+			return errSuccess
+		}).Flag(&flagShort, "short", command.BoolFlag(false), "Print instance id")
+	}
 
 	c.Command("version", "Display version information", func(args []string) error {
 		fmt.Println(internal.Version())
@@ -238,20 +247,3 @@ func buildCommand(out io.Writer) command.Command {
 
 	return c
 }
-
-func runApp(config *hst.Config) {
-	ctx, stop := signal.NotifyContext(context.Background(),
-		syscall.SIGINT, syscall.SIGTERM)
-	defer stop() // unreachable
-	a := app.MustNew(ctx, std)
-
-	rs := new(app.RunState)
-	if sa, err := a.Seal(config); err != nil {
-		hlog.PrintBaseError(err, "cannot seal app:")
-		internal.Exit(1)
-	} else {
-		internal.Exit(app.PrintRunStateErr(rs, sa.Run(rs)))
-	}
-
-	*(*int)(nil) = 0 // not reached
-}

cmd/hakurei/command_test.go

@@ -68,7 +68,7 @@ Flags:
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
 			out := new(bytes.Buffer)
-			c := buildCommand(out)
+			c := buildCommand(t.Context(), out)
 			if err := c.Parse(tc.args); !errors.Is(err, command.ErrHelp) && !errors.Is(err, flag.ErrHelp) {
 				t.Errorf("Parse: error = %v; want %v",
 					err, command.ErrHelp)

cmd/hakurei/main.go

@@ -4,15 +4,17 @@ package main
 //go:generate cp ../../LICENSE .
 
 import (
+	"context"
 	_ "embed"
 	"errors"
 	"log"
 	"os"
+	"os/signal"
+	"syscall"
 
 	"hakurei.app/container"
 	"hakurei.app/internal"
 	"hakurei.app/internal/hlog"
-	"hakurei.app/internal/sys"
 )
 
 var (
@@ -24,12 +26,15 @@ var (
 
 func init() { hlog.Prepare("hakurei") }
 
-var std sys.State = new(sys.Std)
-
 func main() {
 	// early init path, skips root check and duplicate PR_SET_DUMPABLE
 	container.TryArgv0(hlog.Output{}, hlog.Prepare, internal.InstallOutput)
 
+	if err := container.SetPtracer(0); err != nil {
+		hlog.Verbosef("cannot enable ptrace protection via Yama LSM: %v", err)
+		// not fatal: this program runs as the privileged user
+	}
+
 	if err := container.SetDumpable(container.SUID_DUMP_DISABLE); err != nil {
 		log.Printf("cannot set SUID_DUMP_DISABLE: %s", err)
 		// not fatal: this program runs as the privileged user
@@ -39,7 +44,11 @@ func main() {
 		log.Fatal("this program must not run as root")
 	}
 
-	buildCommand(os.Stderr).MustParse(os.Args[1:], func(err error) {
+	ctx, stop := signal.NotifyContext(context.Background(),
+		syscall.SIGINT, syscall.SIGTERM)
+	defer stop() // unreachable
+
+	buildCommand(ctx, os.Stderr).MustParse(os.Args[1:], func(err error) {
 		hlog.Verbosef("command returned %v", err)
 		if errors.Is(err, errSuccess) {
 			hlog.BeforeExit()

cmd/hakurei/parse.go

@@ -11,6 +11,7 @@ import (
 	"syscall"
 
 	"hakurei.app/hst"
+	"hakurei.app/internal/app"
 	"hakurei.app/internal/app/state"
 	"hakurei.app/internal/hlog"
 )
@@ -87,7 +88,9 @@ func tryShort(name string) (config *hst.Config, entry *state.State) {
 	if likePrefix && len(name) >= 8 {
 		hlog.Verbose("argument looks like prefix")
 
-		s := state.NewMulti(std.Paths().RunDirPath)
+		var sc hst.Paths
+		app.CopyPaths(&sc, new(app.Hsu).MustID())
+		s := state.NewMulti(sc.RunDirPath.String())
 		if entries, err := state.Join(s); err != nil {
 			log.Printf("cannot join store: %v", err)
 			// drop to fetch from file

cmd/hakurei/print.go

@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"io"
 	"log"
-	"os"
 	"slices"
 	"strconv"
 	"strings"
@@ -13,8 +12,8 @@ import (
 	"time"
 
 	"hakurei.app/hst"
+	"hakurei.app/internal/app"
 	"hakurei.app/internal/app/state"
-	"hakurei.app/internal/hlog"
 	"hakurei.app/system/dbus"
 )
 
@@ -22,15 +21,8 @@ func printShowSystem(output io.Writer, short, flagJSON bool) {
 	t := newPrinter(output)
 	defer t.MustFlush()
 
-	info := new(hst.Info)
-
-	// get fid by querying uid of aid 0
-	if uid, err := std.Uid(0); err != nil {
-		hlog.PrintBaseError(err, "cannot obtain uid from setuid wrapper:")
-		os.Exit(1)
-	} else {
-		info.User = (uid / 10000) - 100
-	}
+	info := &hst.Info{User: new(app.Hsu).MustID()}
+	app.CopyPaths(&info.Paths, info.User)
 
 	if flagJSON {
 		printJSON(output, short, info)
@@ -38,6 +30,10 @@ func printShowSystem(output io.Writer, short, flagJSON bool) {
 	}
 
 	t.Printf("User:\t%d\n", info.User)
+	t.Printf("TempDir:\t%s\n", info.TempDir)
+	t.Printf("SharePath:\t%s\n", info.SharePath)
+	t.Printf("RuntimePath:\t%s\n", info.RuntimePath)
+	t.Printf("RunDirPath:\t%s\n", info.RunDirPath)
 }
 
 func printShowInstance(
@@ -73,17 +69,17 @@ func printShowInstance(
 	} else {
 		t.Printf(" Identity:\t%d\n", config.Identity)
 	}
-	t.Printf(" Enablements:\t%s\n", config.Enablements.String())
+	t.Printf(" Enablements:\t%s\n", config.Enablements.Unwrap().String())
 	if len(config.Groups) > 0 {
 		t.Printf(" Groups:\t%s\n", strings.Join(config.Groups, ", "))
 	}
-	if config.Data != "" {
-		t.Printf(" Data:\t%s\n", config.Data)
+	if config.Home != nil {
+		t.Printf(" Home:\t%s\n", config.Home)
 	}
 	if config.Container != nil {
-		container := config.Container
-		if container.Hostname != "" {
-			t.Printf(" Hostname:\t%s\n", container.Hostname)
+		params := config.Container
+		if params.Hostname != "" {
+			t.Printf(" Hostname:\t%s\n", params.Hostname)
 		}
 		flags := make([]string, 0, 7)
 		writeFlag := func(name string, value bool) {
@@ -91,30 +87,22 @@ func printShowInstance(
 				flags = append(flags, name)
 			}
 		}
-		writeFlag("userns", container.Userns)
-		writeFlag("devel", container.Devel)
-		writeFlag("net", container.Net)
-		writeFlag("device", container.Device)
-		writeFlag("tty", container.Tty)
-		writeFlag("mapuid", container.MapRealUID)
+		writeFlag("userns", params.Userns)
+		writeFlag("devel", params.Devel)
+		writeFlag("net", params.HostNet)
+		writeFlag("abstract", params.HostAbstract)
+		writeFlag("device", params.Device)
+		writeFlag("tty", params.Tty)
+		writeFlag("mapuid", params.MapRealUID)
 		writeFlag("directwl", config.DirectWayland)
-		writeFlag("autoetc", container.AutoEtc)
 		if len(flags) == 0 {
 			flags = append(flags, "none")
 		}
 		t.Printf(" Flags:\t%s\n", strings.Join(flags, " "))
 
-		etc := container.Etc
-		if etc == "" {
-			etc = "/etc"
+		if config.Path != nil {
+			t.Printf(" Path:\t%s\n", config.Path)
 		}
-		t.Printf(" Etc:\t%s\n", etc)
-
-		if len(container.Cover) > 0 {
-			t.Printf(" Cover:\t%s\n", strings.Join(container.Cover, " "))
-		}
-
-		t.Printf(" Path:\t%s\n", config.Path)
 	}
 	if len(config.Args) > 0 {
 		t.Printf(" Arguments:\t%s\n", strings.Join(config.Args, " "))
@@ -125,30 +113,11 @@ func printShowInstance(
 		if config.Container != nil && len(config.Container.Filesystem) > 0 {
 			t.Printf("Filesystem\n")
 			for _, f := range config.Container.Filesystem {
-				if f == nil {
+				if !f.Valid() {
+					t.Println(" <invalid>")
 					continue
 				}
-
-				expr := new(strings.Builder)
-				expr.Grow(3 + len(f.Src) + 1 + len(f.Dst))
-
-				if f.Device {
-					expr.WriteString(" d")
-				} else if f.Write {
-					expr.WriteString(" w")
-				} else {
-					expr.WriteString(" ")
-				}
-				if f.Must {
-					expr.WriteString("*")
-				} else {
-					expr.WriteString("+")
-				}
-				expr.WriteString(f.Src)
-				if f.Dst != "" {
-					expr.WriteString(":" + f.Dst)
-				}
-				t.Printf("%s\n", expr.String())
+				t.Printf(" %s\n", f)
 			}
 			t.Printf("\n")
 		}

cmd/hakurei/print_test.go

@@ -39,20 +39,21 @@ func Test_printShowInstance(t *testing.T) {
  Identity:       9 (org.chromium.Chromium)
  Enablements:    wayland, dbus, pulseaudio
  Groups:         video, dialout, plugdev
- Data:           /var/lib/hakurei/u0/org.chromium.Chromium
+ Home:           /data/data/org.chromium.Chromium
  Hostname:       localhost
- Flags:          userns devel net device tty mapuid autoetc
- Etc:            /etc
- Cover:          /var/run/nscd
+ Flags:          userns devel net abstract device tty mapuid
  Path:           /run/current-system/sw/bin/chromium
  Arguments:      chromium --ignore-gpu-blocklist --disable-smooth-scrolling --enable-features=UseOzonePlatform --ozone-platform=wayland
 
 Filesystem
- +/nix/store
- +/run/current-system
- +/run/opengl-driver
- +/var/db/nix-channels
- w*/var/lib/hakurei/u0/org.chromium.Chromium:/data/data/org.chromium.Chromium
+ autoroot:w:/var/lib/hakurei/base/org.debian
+ autoetc:/etc/
+ w+ephemeral(-rwxr-xr-x):/tmp/
+ w*/nix/store:/mnt-root/nix/.rw-store/upper:/mnt-root/nix/.rw-store/work:/mnt-root/nix/.ro-store
+ */nix/store
+ /run/current-system@
+ /run/opengl-driver@
+ w-/var/lib/hakurei/u0/org.chromium.Chromium:/data/data/org.chromium.Chromium
  d+/dev/dri
 
 Extra ACL
@@ -82,18 +83,15 @@ App
  Identity:       0
  Enablements:    (no enablements)
  Flags:          none
- Etc:            /etc
- Path:           
 
 `},
-		{"config nil entries", nil, &hst.Config{Container: &hst.ContainerConfig{Filesystem: make([]*hst.FilesystemConfig, 1)}, ExtraPerms: make([]*hst.ExtraPermConfig, 1)}, false, false, `App
+		{"config nil entries", nil, &hst.Config{Container: &hst.ContainerConfig{Filesystem: make([]hst.FilesystemConfigJSON, 1)}, ExtraPerms: make([]*hst.ExtraPermConfig, 1)}, false, false, `App
  Identity:       0
  Enablements:    (no enablements)
  Flags:          none
- Etc:            /etc
- Path:           
 
 Filesystem
+ <invalid>
 
 Extra ACL
 
@@ -118,20 +116,21 @@ App
  Identity:       9 (org.chromium.Chromium)
  Enablements:    wayland, dbus, pulseaudio
  Groups:         video, dialout, plugdev
- Data:           /var/lib/hakurei/u0/org.chromium.Chromium
+ Home:           /data/data/org.chromium.Chromium
  Hostname:       localhost
- Flags:          userns devel net device tty mapuid autoetc
- Etc:            /etc
- Cover:          /var/run/nscd
+ Flags:          userns devel net abstract device tty mapuid
  Path:           /run/current-system/sw/bin/chromium
  Arguments:      chromium --ignore-gpu-blocklist --disable-smooth-scrolling --enable-features=UseOzonePlatform --ozone-platform=wayland
 
 Filesystem
- +/nix/store
- +/run/current-system
- +/run/opengl-driver
- +/var/db/nix-channels
- w*/var/lib/hakurei/u0/org.chromium.Chromium:/data/data/org.chromium.Chromium
+ autoroot:w:/var/lib/hakurei/base/org.debian
+ autoetc:/etc/
+ w+ephemeral(-rwxr-xr-x):/tmp/
+ w*/nix/store:/mnt-root/nix/.rw-store/upper:/mnt-root/nix/.rw-store/work:/mnt-root/nix/.ro-store
+ */nix/store
+ /run/current-system@
+ /run/opengl-driver@
+ w-/var/lib/hakurei/u0/org.chromium.Chromium:/data/data/org.chromium.Chromium
  d+/dev/dri
 
 Extra ACL
@@ -194,7 +193,11 @@ App
       "--enable-features=UseOzonePlatform",
       "--ozone-platform=wayland"
     ],
-    "enablements": 13,
+    "enablements": {
+      "wayland": true,
+      "dbus": true,
+      "pulse": true
+    },
     "session_bus": {
       "see": null,
       "talk": [
@@ -233,8 +236,7 @@ App
     },
     "username": "chronos",
     "shell": "/run/current-system/sw/bin/zsh",
-    "data": "/var/lib/hakurei/u0/org.chromium.Chromium",
-    "dir": "/data/data/org.chromium.Chromium",
+    "home": "/data/data/org.chromium.Chromium",
     "extra_perms": [
       {
         "ensure": true,
@@ -256,11 +258,14 @@ App
     ],
     "container": {
       "hostname": "localhost",
+      "wait_delay": -1,
       "seccomp_flags": 1,
       "seccomp_presets": 1,
+      "seccomp_compat": true,
       "devel": true,
       "userns": true,
-      "net": true,
+      "host_net": true,
+      "host_abstract": true,
       "tty": true,
       "multiarch": true,
       "env": {
@@ -272,38 +277,62 @@ App
       "device": true,
       "filesystem": [
         {
+          "type": "bind",
+          "dst": "/",
+          "src": "/var/lib/hakurei/base/org.debian",
+          "write": true,
+          "special": true
+        },
+        {
+          "type": "bind",
+          "dst": "/etc/",
+          "src": "/etc/",
+          "special": true
+        },
+        {
+          "type": "ephemeral",
+          "dst": "/tmp/",
+          "write": true,
+          "perm": 493
+        },
+        {
+          "type": "overlay",
+          "dst": "/nix/store",
+          "lower": [
+            "/mnt-root/nix/.ro-store"
+          ],
+          "upper": "/mnt-root/nix/.rw-store/upper",
+          "work": "/mnt-root/nix/.rw-store/work"
+        },
+        {
+          "type": "bind",
           "src": "/nix/store"
         },
         {
-          "src": "/run/current-system"
+          "type": "link",
+          "dst": "/run/current-system",
+          "linkname": "/run/current-system",
+          "dereference": true
         },
         {
-          "src": "/run/opengl-driver"
-        },
-        {
-          "src": "/var/db/nix-channels"
+          "type": "link",
+          "dst": "/run/opengl-driver",
+          "linkname": "/run/opengl-driver",
+          "dereference": true
         },
         {
+          "type": "bind",
           "dst": "/data/data/org.chromium.Chromium",
           "src": "/var/lib/hakurei/u0/org.chromium.Chromium",
           "write": true,
-          "require": true
+          "ensure": true
         },
         {
+          "type": "bind",
           "src": "/dev/dri",
-          "dev": true
+          "dev": true,
+          "optional": true
         }
-      ],
-      "symlink": [
-        [
-          "/run/user/65534",
-          "/run/user/150"
-        ]
-      ],
-      "etc": "/etc",
-      "auto_etc": true,
-      "cover": [
-        "/var/run/nscd"
       ]
     }
   },
@@ -320,7 +349,11 @@ App
     "--enable-features=UseOzonePlatform",
     "--ozone-platform=wayland"
   ],
-  "enablements": 13,
+  "enablements": {
+    "wayland": true,
+    "dbus": true,
+    "pulse": true
+  },
   "session_bus": {
     "see": null,
     "talk": [
@@ -359,8 +392,7 @@ App
   },
   "username": "chronos",
   "shell": "/run/current-system/sw/bin/zsh",
-  "data": "/var/lib/hakurei/u0/org.chromium.Chromium",
-  "dir": "/data/data/org.chromium.Chromium",
+  "home": "/data/data/org.chromium.Chromium",
   "extra_perms": [
     {
       "ensure": true,
@@ -382,11 +414,14 @@ App
   ],
   "container": {
     "hostname": "localhost",
+    "wait_delay": -1,
     "seccomp_flags": 1,
     "seccomp_presets": 1,
+    "seccomp_compat": true,
     "devel": true,
     "userns": true,
-    "net": true,
+    "host_net": true,
+    "host_abstract": true,
     "tty": true,
     "multiarch": true,
     "env": {
@@ -398,38 +433,62 @@ App
     "device": true,
     "filesystem": [
       {
+        "type": "bind",
+        "dst": "/",
+        "src": "/var/lib/hakurei/base/org.debian",
+        "write": true,
+        "special": true
+      },
+      {
+        "type": "bind",
+        "dst": "/etc/",
+        "src": "/etc/",
+        "special": true
+      },
+      {
+        "type": "ephemeral",
+        "dst": "/tmp/",
+        "write": true,
+        "perm": 493
+      },
+      {
+        "type": "overlay",
+        "dst": "/nix/store",
+        "lower": [
+          "/mnt-root/nix/.ro-store"
+        ],
+        "upper": "/mnt-root/nix/.rw-store/upper",
+        "work": "/mnt-root/nix/.rw-store/work"
+      },
+      {
+        "type": "bind",
         "src": "/nix/store"
       },
       {
-        "src": "/run/current-system"
+        "type": "link",
+        "dst": "/run/current-system",
+        "linkname": "/run/current-system",
+        "dereference": true
       },
       {
-        "src": "/run/opengl-driver"
-      },
-      {
-        "src": "/var/db/nix-channels"
+        "type": "link",
+        "dst": "/run/opengl-driver",
+        "linkname": "/run/opengl-driver",
+        "dereference": true
       },
       {
+        "type": "bind",
         "dst": "/data/data/org.chromium.Chromium",
         "src": "/var/lib/hakurei/u0/org.chromium.Chromium",
         "write": true,
-        "require": true
+        "ensure": true
       },
       {
+        "type": "bind",
         "src": "/dev/dri",
-        "dev": true
+        "dev": true,
+        "optional": true
       }
-    ],
-    "symlink": [
-      [
-        "/run/user/65534",
-        "/run/user/150"
-      ]
-    ],
-    "etc": "/etc",
-    "auto_etc": true,
-    "cover": [
-      "/var/run/nscd"
     ]
   }
 }
@@ -500,7 +559,11 @@ func Test_printPs(t *testing.T) {
         "--enable-features=UseOzonePlatform",
         "--ozone-platform=wayland"
       ],
-      "enablements": 13,
+      "enablements": {
+        "wayland": true,
+        "dbus": true,
+        "pulse": true
+      },
       "session_bus": {
         "see": null,
         "talk": [
@@ -539,8 +602,7 @@ func Test_printPs(t *testing.T) {
       },
       "username": "chronos",
       "shell": "/run/current-system/sw/bin/zsh",
-      "data": "/var/lib/hakurei/u0/org.chromium.Chromium",
-      "dir": "/data/data/org.chromium.Chromium",
+      "home": "/data/data/org.chromium.Chromium",
       "extra_perms": [
         {
           "ensure": true,
@@ -562,11 +624,14 @@ func Test_printPs(t *testing.T) {
       ],
       "container": {
         "hostname": "localhost",
+        "wait_delay": -1,
         "seccomp_flags": 1,
         "seccomp_presets": 1,
+        "seccomp_compat": true,
         "devel": true,
         "userns": true,
-        "net": true,
+        "host_net": true,
+        "host_abstract": true,
         "tty": true,
         "multiarch": true,
         "env": {
@@ -578,38 +643,62 @@ func Test_printPs(t *testing.T) {
         "device": true,
         "filesystem": [
           {
+            "type": "bind",
+            "dst": "/",
+            "src": "/var/lib/hakurei/base/org.debian",
+            "write": true,
+            "special": true
+          },
+          {
+            "type": "bind",
+            "dst": "/etc/",
+            "src": "/etc/",
+            "special": true
+          },
+          {
+            "type": "ephemeral",
+            "dst": "/tmp/",
+            "write": true,
+            "perm": 493
+          },
+          {
+            "type": "overlay",
+            "dst": "/nix/store",
+            "lower": [
+              "/mnt-root/nix/.ro-store"
+            ],
+            "upper": "/mnt-root/nix/.rw-store/upper",
+            "work": "/mnt-root/nix/.rw-store/work"
+          },
+          {
+            "type": "bind",
             "src": "/nix/store"
           },
           {
-            "src": "/run/current-system"
+            "type": "link",
+            "dst": "/run/current-system",
+            "linkname": "/run/current-system",
+            "dereference": true
           },
           {
-            "src": "/run/opengl-driver"
-          },
-          {
-            "src": "/var/db/nix-channels"
+            "type": "link",
+            "dst": "/run/opengl-driver",
+            "linkname": "/run/opengl-driver",
+            "dereference": true
           },
           {
+            "type": "bind",
             "dst": "/data/data/org.chromium.Chromium",
             "src": "/var/lib/hakurei/u0/org.chromium.Chromium",
             "write": true,
-            "require": true
+            "ensure": true
           },
           {
+            "type": "bind",
             "src": "/dev/dri",
-            "dev": true
+            "dev": true,
+            "optional": true
           }
-        ],
-        "symlink": [
-          [
-            "/run/user/65534",
-            "/run/user/150"
-          ]
-        ],
-        "etc": "/etc",
-        "auto_etc": true,
-        "cover": [
-          "/var/run/nscd"
         ]
       }
     },

cmd/hpkg/README

@@ -0,0 +1,7 @@
+This program is a proof of concept and is now deprecated. It is only kept
+around for API demonstration purposes and to make the most out of the test
+suite.
+
+This program is replaced by planterette, which can be found at
+https://git.gensokyo.uk/security/planterette. Development effort should be
+focused there instead.

cmd/hpkg/app.go

@@ -4,11 +4,10 @@ import (
 	"encoding/json"
 	"log"
 	"os"
-	"path"
 
+	"hakurei.app/container"
 	"hakurei.app/container/seccomp"
 	"hakurei.app/hst"
-	"hakurei.app/system"
 	"hakurei.app/system/dbus"
 )
 
@@ -27,7 +26,9 @@ type appInfo struct {
 	// passed through to [hst.Config]
 	Userns bool `json:"userns,omitempty"`
 	// passed through to [hst.Config]
-	Net bool `json:"net,omitempty"`
+	HostNet bool `json:"net,omitempty"`
+	// passed through to [hst.Config]
+	HostAbstract bool `json:"abstract,omitempty"`
 	// passed through to [hst.Config]
 	Device bool `json:"dev,omitempty"`
 	// passed through to [hst.Config]
@@ -41,7 +42,7 @@ type appInfo struct {
 	// passed through to [hst.Config]
 	SessionBus *dbus.Config `json:"session_bus,omitempty"`
 	// passed through to [hst.Config]
-	Enablements system.Enablement `json:"enablements"`
+	Enablements *hst.Enablements `json:"enablements,omitempty"`
 
 	// passed through to [hst.Config]
 	Multiarch bool `json:"multiarch,omitempty"`
@@ -55,18 +56,18 @@ type appInfo struct {
 	// store path to nixGL source
 	NixGL string `json:"nix_gl,omitempty"`
 	// store path to activate-and-exec script
-	Launcher string `json:"launcher"`
+	Launcher *container.Absolute `json:"launcher"`
 	// store path to /run/current-system
-	CurrentSystem string `json:"current_system"`
+	CurrentSystem *container.Absolute `json:"current_system"`
 	// store path to home-manager activation package
 	ActivationPackage string `json:"activation_package"`
 }
 
-func (app *appInfo) toFst(pathSet *appPathSet, argv []string, flagDropShell bool) *hst.Config {
+func (app *appInfo) toHst(pathSet *appPathSet, pathname *container.Absolute, argv []string, flagDropShell bool) *hst.Config {
 	config := &hst.Config{
 		ID: app.ID,
 
-		Path: argv[0],
+		Path: pathname,
 		Args: argv,
 
 		Enablements: app.Enablements,
@@ -76,38 +77,36 @@ func (app *appInfo) toFst(pathSet *appPathSet, argv []string, flagDropShell bool
 		DirectWayland: app.DirectWayland,
 
 		Username: "hakurei",
-		Shell:    shellPath,
-		Data:     pathSet.homeDir,
-		Dir:      path.Join("/data/data", app.ID),
+		Shell:    pathShell,
+		Home:     pathDataData.Append(app.ID),
 
 		Identity: app.Identity,
 		Groups:   app.Groups,
 
 		Container: &hst.ContainerConfig{
-			Hostname:   formatHostname(app.Name),
-			Devel:      app.Devel,
-			Userns:     app.Userns,
-			Net:        app.Net,
-			Device:     app.Device,
-			Tty:        app.Tty || flagDropShell,
-			MapRealUID: app.MapRealUID,
-			Filesystem: []*hst.FilesystemConfig{
-				{Src: path.Join(pathSet.nixPath, "store"), Dst: "/nix/store", Must: true},
-				{Src: pathSet.metaPath, Dst: path.Join(hst.Tmp, "app"), Must: true},
-				{Src: "/etc/resolv.conf"},
-				{Src: "/sys/block"},
-				{Src: "/sys/bus"},
-				{Src: "/sys/class"},
-				{Src: "/sys/dev"},
-				{Src: "/sys/devices"},
+			Hostname:     formatHostname(app.Name),
+			Devel:        app.Devel,
+			Userns:       app.Userns,
+			HostNet:      app.HostNet,
+			HostAbstract: app.HostAbstract,
+			Device:       app.Device,
+			Tty:          app.Tty || flagDropShell,
+			MapRealUID:   app.MapRealUID,
+			Filesystem: []hst.FilesystemConfigJSON{
+				{FilesystemConfig: &hst.FSBind{Target: container.AbsFHSEtc, Source: pathSet.cacheDir.Append("etc"), Special: true}},
+				{FilesystemConfig: &hst.FSBind{Source: pathSet.nixPath.Append("store"), Target: pathNixStore}},
+				{FilesystemConfig: &hst.FSLink{Target: pathCurrentSystem, Linkname: app.CurrentSystem.String()}},
+				{FilesystemConfig: &hst.FSLink{Target: pathBin, Linkname: pathSwBin.String()}},
+				{FilesystemConfig: &hst.FSLink{Target: container.AbsFHSUsrBin, Linkname: pathSwBin.String()}},
+				{FilesystemConfig: &hst.FSBind{Source: pathSet.metaPath, Target: hst.AbsTmp.Append("app")}},
+				{FilesystemConfig: &hst.FSBind{Source: container.AbsFHSEtc.Append("resolv.conf"), Optional: true}},
+				{FilesystemConfig: &hst.FSBind{Source: container.AbsFHSSys.Append("block"), Optional: true}},
+				{FilesystemConfig: &hst.FSBind{Source: container.AbsFHSSys.Append("bus"), Optional: true}},
+				{FilesystemConfig: &hst.FSBind{Source: container.AbsFHSSys.Append("class"), Optional: true}},
+				{FilesystemConfig: &hst.FSBind{Source: container.AbsFHSSys.Append("dev"), Optional: true}},
+				{FilesystemConfig: &hst.FSBind{Source: container.AbsFHSSys.Append("devices"), Optional: true}},
+				{FilesystemConfig: &hst.FSBind{Target: pathDataData.Append(app.ID), Source: pathSet.homeDir, Write: true, Ensure: true}},
 			},
-			Link: [][2]string{
-				{app.CurrentSystem, "/run/current-system"},
-				{"/run/current-system/sw/bin", "/bin"},
-				{"/run/current-system/sw/bin", "/usr/bin"},
-			},
-			Etc:     path.Join(pathSet.cacheDir, "etc"),
-			AutoEtc: true,
 		},
 		ExtraPerms: []*hst.ExtraPermConfig{
 			{Path: dataHome, Execute: true},
@@ -140,6 +139,14 @@ func loadAppInfo(name string, beforeFail func()) *appInfo {
 		beforeFail()
 		log.Fatal("application identifier must not be empty")
 	}
+	if bundle.Launcher == nil {
+		beforeFail()
+		log.Fatal("launcher must not be empty")
+	}
+	if bundle.CurrentSystem == nil {
+		beforeFail()
+		log.Fatal("current-system must not be empty")
+	}
 
 	return bundle
 }

cmd/hpkg/build.nix

@@ -171,7 +171,12 @@ let
           broadcast = { };
         });
 
-    enablements = (if allow_wayland then 1 else 0) + (if allow_x11 then 2 else 0) + (if allow_dbus then 4 else 0) + (if allow_pulse then 8 else 0);
+    enablements = {
+      wayland = allow_wayland;
+      x11 = allow_x11;
+      dbus = allow_dbus;
+      pulse = allow_pulse;
+    };
 
     mesa = if gpu then mesaWrappers else null;
     nix_gl = if gpu then nixGL else null;
@@ -215,15 +220,14 @@ stdenv.mkDerivation {
     # create binary cache
     closureInfo="${
       closureInfo {
-        rootPaths =
-          [
-            homeManagerConfiguration.activationPackage
-            launcher
-          ]
-          ++ optionals gpu [
-            mesaWrappers
-            nixGL
-          ];
+        rootPaths = [
+          homeManagerConfiguration.activationPackage
+          launcher
+        ]
+        ++ optionals gpu [
+          mesaWrappers
+          nixGL
+        ];
       }
     }"
     echo "copying application paths..."

cmd/hpkg/main.go

@@ -11,20 +11,19 @@ import (
 	"syscall"
 
 	"hakurei.app/command"
+	"hakurei.app/container"
 	"hakurei.app/hst"
 	"hakurei.app/internal"
 	"hakurei.app/internal/hlog"
 )
 
-const shellPath = "/run/current-system/sw/bin/bash"
-
 var (
 	errSuccess = errors.New("success")
 )
 
 func init() {
-	hlog.Prepare("planterette")
-	if err := os.Setenv("SHELL", shellPath); err != nil {
+	hlog.Prepare("hpkg")
+	if err := os.Setenv("SHELL", pathShell.String()); err != nil {
 		log.Fatalf("cannot set $SHELL: %v", err)
 	}
 }
@@ -42,7 +41,7 @@ func main() {
 		flagVerbose   bool
 		flagDropShell bool
 	)
-	c := command.New(os.Stderr, log.Printf, "planterette", func([]string) error { internal.InstallOutput(flagVerbose); return nil }).
+	c := command.New(os.Stderr, log.Printf, "hpkg", func([]string) error { internal.InstallOutput(flagVerbose); return nil }).
 		Flag(&flagVerbose, "v", command.BoolFlag(false), "Print debug messages to the console").
 		Flag(&flagDropShell, "s", command.BoolFlag(false), "Drop to a shell in place of next hakurei action")
 
@@ -66,7 +65,7 @@ func main() {
 			}
 
 			/*
-				Look up paths to programs started by planterette.
+				Look up paths to programs started by hpkg.
 				This is done here to ease error handling as cleanup is not yet required.
 			*/
 
@@ -81,31 +80,32 @@ func main() {
 				Extract package and set up for cleanup.
 			*/
 
-			var workDir string
-			if p, err := os.MkdirTemp("", "planterette.*"); err != nil {
+			var workDir *container.Absolute
+			if p, err := os.MkdirTemp("", "hpkg.*"); err != nil {
 				log.Printf("cannot create temporary directory: %v", err)
 				return err
-			} else {
-				workDir = p
+			} else if workDir, err = container.NewAbs(p); err != nil {
+				log.Printf("invalid temporary directory: %v", err)
+				return err
 			}
 			cleanup := func() {
 				// should be faster than a native implementation
-				mustRun(chmod, "-R", "+w", workDir)
-				mustRun(rm, "-rf", workDir)
+				mustRun(chmod, "-R", "+w", workDir.String())
+				mustRun(rm, "-rf", workDir.String())
 			}
 			beforeRunFail.Store(&cleanup)
 
-			mustRun(tar, "-C", workDir, "-xf", pkgPath)
+			mustRun(tar, "-C", workDir.String(), "-xf", pkgPath)
 
 			/*
 				Parse bundle and app metadata, do pre-install checks.
 			*/
 
-			bundle := loadAppInfo(path.Join(workDir, "bundle.json"), cleanup)
+			bundle := loadAppInfo(path.Join(workDir.String(), "bundle.json"), cleanup)
 			pathSet := pathSetByApp(bundle.ID)
 
 			a := bundle
-			if s, err := os.Stat(pathSet.metaPath); err != nil {
+			if s, err := os.Stat(pathSet.metaPath.String()); err != nil {
 				if !os.IsNotExist(err) {
 					cleanup()
 					log.Printf("cannot access %q: %v", pathSet.metaPath, err)
@@ -117,7 +117,7 @@ func main() {
 				log.Printf("metadata path %q is not a file", pathSet.metaPath)
 				return syscall.EBADMSG
 			} else {
-				a = loadAppInfo(pathSet.metaPath, cleanup)
+				a = loadAppInfo(pathSet.metaPath.String(), cleanup)
 				if a.ID != bundle.ID {
 					cleanup()
 					log.Printf("app %q claims to have identifier %q",
@@ -208,7 +208,7 @@ func main() {
 			*/
 
 			// serialise metadata to ensure consistency
-			if f, err := os.OpenFile(pathSet.metaPath+"~", os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0644); err != nil {
+			if f, err := os.OpenFile(pathSet.metaPath.String()+"~", os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0644); err != nil {
 				cleanup()
 				log.Printf("cannot create metadata file: %v", err)
 				return err
@@ -221,7 +221,7 @@ func main() {
 				// not fatal
 			}
 
-			if err := os.Rename(pathSet.metaPath+"~", pathSet.metaPath); err != nil {
+			if err := os.Rename(pathSet.metaPath.String()+"~", pathSet.metaPath.String()); err != nil {
 				cleanup()
 				log.Printf("cannot rename metadata file: %v", err)
 				return err
@@ -250,7 +250,7 @@ func main() {
 
 			id := args[0]
 			pathSet := pathSetByApp(id)
-			a := loadAppInfo(pathSet.metaPath, func() {})
+			a := loadAppInfo(pathSet.metaPath.String(), func() {})
 			if a.ID != id {
 				log.Printf("app %q claims to have identifier %q", id, a.ID)
 				return syscall.EBADE
@@ -274,13 +274,13 @@ func main() {
 						"--override-input nixpkgs path:/etc/nixpkgs " +
 						"path:" + a.NixGL + "#nixVulkanNvidia",
 				}, true, func(config *hst.Config) *hst.Config {
-					config.Container.Filesystem = append(config.Container.Filesystem, []*hst.FilesystemConfig{
-						{Src: "/etc/resolv.conf"},
-						{Src: "/sys/block"},
-						{Src: "/sys/bus"},
-						{Src: "/sys/class"},
-						{Src: "/sys/dev"},
-						{Src: "/sys/devices"},
+					config.Container.Filesystem = append(config.Container.Filesystem, []hst.FilesystemConfigJSON{
+						{FilesystemConfig: &hst.FSBind{Source: container.AbsFHSEtc.Append("resolv.conf"), Optional: true}},
+						{FilesystemConfig: &hst.FSBind{Source: container.AbsFHSSys.Append("block"), Optional: true}},
+						{FilesystemConfig: &hst.FSBind{Source: container.AbsFHSSys.Append("bus"), Optional: true}},
+						{FilesystemConfig: &hst.FSBind{Source: container.AbsFHSSys.Append("class"), Optional: true}},
+						{FilesystemConfig: &hst.FSBind{Source: container.AbsFHSSys.Append("dev"), Optional: true}},
+						{FilesystemConfig: &hst.FSBind{Source: container.AbsFHSSys.Append("devices"), Optional: true}},
 					}...)
 					appendGPUFilesystem(config)
 					return config
@@ -291,15 +291,16 @@ func main() {
 				Create app configuration.
 			*/
 
+			pathname := a.Launcher
 			argv := make([]string, 1, len(args))
-			if !flagDropShell {
-				argv[0] = a.Launcher
+			if flagDropShell {
+				pathname = pathShell
+				argv[0] = bash
 			} else {
-				argv[0] = shellPath
+				argv[0] = a.Launcher.String()
 			}
 			argv = append(argv, args[1:]...)
-
-			config := a.toFst(pathSet, argv, flagDropShell)
+			config := a.toHst(pathSet, pathname, argv, flagDropShell)
 
 			/*
 				Expose GPU devices.
@@ -307,7 +308,7 @@ func main() {
 
 			if a.GPU {
 				config.Container.Filesystem = append(config.Container.Filesystem,
-					&hst.FilesystemConfig{Src: path.Join(pathSet.nixPath, ".nixGL"), Dst: path.Join(hst.Tmp, "nixGL")})
+					hst.FilesystemConfigJSON{FilesystemConfig: &hst.FSBind{Source: pathSet.nixPath.Append(".nixGL"), Target: hst.AbsTmp.Append("nixGL")}})
 				appendGPUFilesystem(config)
 			}
 

cmd/hpkg/paths.go

@@ -0,0 +1,116 @@
+package main
+
+import (
+	"log"
+	"os"
+	"os/exec"
+	"strconv"
+	"sync/atomic"
+
+	"hakurei.app/container"
+	"hakurei.app/hst"
+	"hakurei.app/internal/hlog"
+)
+
+const bash = "bash"
+
+var (
+	dataHome *container.Absolute
+)
+
+func init() {
+	// dataHome
+	if a, err := container.NewAbs(os.Getenv("HAKUREI_DATA_HOME")); err == nil {
+		dataHome = a
+	} else {
+		dataHome = container.AbsFHSVarLib.Append("hakurei/" + strconv.Itoa(os.Getuid()))
+	}
+}
+
+var (
+	pathBin = container.AbsFHSRoot.Append("bin")
+
+	pathNix           = container.MustAbs("/nix/")
+	pathNixStore      = pathNix.Append("store/")
+	pathCurrentSystem = container.AbsFHSRun.Append("current-system")
+	pathSwBin         = pathCurrentSystem.Append("sw/bin/")
+	pathShell         = pathSwBin.Append(bash)
+
+	pathData     = container.MustAbs("/data")
+	pathDataData = pathData.Append("data")
+)
+
+func lookPath(file string) string {
+	if p, err := exec.LookPath(file); err != nil {
+		log.Fatalf("%s: command not found", file)
+		return ""
+	} else {
+		return p
+	}
+}
+
+var beforeRunFail = new(atomic.Pointer[func()])
+
+func mustRun(name string, arg ...string) {
+	hlog.Verbosef("spawning process: %q %q", name, arg)
+	cmd := exec.Command(name, arg...)
+	cmd.Stdin, cmd.Stdout, cmd.Stderr = os.Stdin, os.Stdout, os.Stderr
+	if err := cmd.Run(); err != nil {
+		if f := beforeRunFail.Swap(nil); f != nil {
+			(*f)()
+		}
+		log.Fatalf("%s: %v", name, err)
+	}
+}
+
+type appPathSet struct {
+	// ${dataHome}/${id}
+	baseDir *container.Absolute
+	// ${baseDir}/app
+	metaPath *container.Absolute
+	// ${baseDir}/files
+	homeDir *container.Absolute
+	// ${baseDir}/cache
+	cacheDir *container.Absolute
+	// ${baseDir}/cache/nix
+	nixPath *container.Absolute
+}
+
+func pathSetByApp(id string) *appPathSet {
+	pathSet := new(appPathSet)
+	pathSet.baseDir = dataHome.Append(id)
+	pathSet.metaPath = pathSet.baseDir.Append("app")
+	pathSet.homeDir = pathSet.baseDir.Append("files")
+	pathSet.cacheDir = pathSet.baseDir.Append("cache")
+	pathSet.nixPath = pathSet.cacheDir.Append("nix")
+	return pathSet
+}
+
+func appendGPUFilesystem(config *hst.Config) {
+	config.Container.Filesystem = append(config.Container.Filesystem, []hst.FilesystemConfigJSON{
+		// flatpak commit 763a686d874dd668f0236f911de00b80766ffe79
+		{FilesystemConfig: &hst.FSBind{Source: container.AbsFHSDev.Append("dri"), Device: true, Optional: true}},
+		// mali
+		{FilesystemConfig: &hst.FSBind{Source: container.AbsFHSDev.Append("mali"), Device: true, Optional: true}},
+		{FilesystemConfig: &hst.FSBind{Source: container.AbsFHSDev.Append("mali0"), Device: true, Optional: true}},
+		{FilesystemConfig: &hst.FSBind{Source: container.AbsFHSDev.Append("umplock"), Device: true, Optional: true}},
+		// nvidia
+		{FilesystemConfig: &hst.FSBind{Source: container.AbsFHSDev.Append("nvidiactl"), Device: true, Optional: true}},
+		{FilesystemConfig: &hst.FSBind{Source: container.AbsFHSDev.Append("nvidia-modeset"), Device: true, Optional: true}},
+		// nvidia OpenCL/CUDA
+		{FilesystemConfig: &hst.FSBind{Source: container.AbsFHSDev.Append("nvidia-uvm"), Device: true, Optional: true}},
+		{FilesystemConfig: &hst.FSBind{Source: container.AbsFHSDev.Append("nvidia-uvm-tools"), Device: true, Optional: true}},
+
+		// flatpak commit d2dff2875bb3b7e2cd92d8204088d743fd07f3ff
+		{FilesystemConfig: &hst.FSBind{Source: container.AbsFHSDev.Append("nvidia0"), Device: true, Optional: true}}, {FilesystemConfig: &hst.FSBind{Source: container.AbsFHSDev.Append("nvidia1"), Device: true, Optional: true}},
+		{FilesystemConfig: &hst.FSBind{Source: container.AbsFHSDev.Append("nvidia2"), Device: true, Optional: true}}, {FilesystemConfig: &hst.FSBind{Source: container.AbsFHSDev.Append("nvidia3"), Device: true, Optional: true}},
+		{FilesystemConfig: &hst.FSBind{Source: container.AbsFHSDev.Append("nvidia4"), Device: true, Optional: true}}, {FilesystemConfig: &hst.FSBind{Source: container.AbsFHSDev.Append("nvidia5"), Device: true, Optional: true}},
+		{FilesystemConfig: &hst.FSBind{Source: container.AbsFHSDev.Append("nvidia6"), Device: true, Optional: true}}, {FilesystemConfig: &hst.FSBind{Source: container.AbsFHSDev.Append("nvidia7"), Device: true, Optional: true}},
+		{FilesystemConfig: &hst.FSBind{Source: container.AbsFHSDev.Append("nvidia8"), Device: true, Optional: true}}, {FilesystemConfig: &hst.FSBind{Source: container.AbsFHSDev.Append("nvidia9"), Device: true, Optional: true}},
+		{FilesystemConfig: &hst.FSBind{Source: container.AbsFHSDev.Append("nvidia10"), Device: true, Optional: true}}, {FilesystemConfig: &hst.FSBind{Source: container.AbsFHSDev.Append("nvidia11"), Device: true, Optional: true}},
+		{FilesystemConfig: &hst.FSBind{Source: container.AbsFHSDev.Append("nvidia12"), Device: true, Optional: true}}, {FilesystemConfig: &hst.FSBind{Source: container.AbsFHSDev.Append("nvidia13"), Device: true, Optional: true}},
+		{FilesystemConfig: &hst.FSBind{Source: container.AbsFHSDev.Append("nvidia14"), Device: true, Optional: true}}, {FilesystemConfig: &hst.FSBind{Source: container.AbsFHSDev.Append("nvidia15"), Device: true, Optional: true}},
+		{FilesystemConfig: &hst.FSBind{Source: container.AbsFHSDev.Append("nvidia16"), Device: true, Optional: true}}, {FilesystemConfig: &hst.FSBind{Source: container.AbsFHSDev.Append("nvidia17"), Device: true, Optional: true}},
+		{FilesystemConfig: &hst.FSBind{Source: container.AbsFHSDev.Append("nvidia18"), Device: true, Optional: true}}, {FilesystemConfig: &hst.FSBind{Source: container.AbsFHSDev.Append("nvidia19"), Device: true, Optional: true}},
+	}...)
+}

cmd/hpkg/test/default.nix

@@ -9,7 +9,7 @@ let
   buildPackage = self.buildPackage.${system};
 in
 nixosTest {
-  name = "planterette";
+  name = "hpkg";
   nodes.machine = {
     environment.etc = {
       "foot.pkg".source = callPackage ./foot.nix { inherit buildPackage; };

cmd/hpkg/test/test.py

@@ -79,20 +79,20 @@ print(machine.succeed("sudo -u alice -i hakurei version"))
 machine.wait_for_file("/run/user/1000/wayland-1")
 machine.wait_for_file("/tmp/sway-ipc.sock")
 
-# Prepare planterette directory:
+# Prepare hpkg directory:
 machine.succeed("install -dm 0700 -o alice -g users /var/lib/hakurei/1000")
 
-# Install planterette app:
-swaymsg("exec planterette -v install /etc/foot.pkg && touch /tmp/planterette-install-ok")
-machine.wait_for_file("/tmp/planterette-install-ok")
+# Install hpkg app:
+swaymsg("exec hpkg -v install /etc/foot.pkg && touch /tmp/hpkg-install-ok")
+machine.wait_for_file("/tmp/hpkg-install-ok")
 
 # Start app (foot) with Wayland enablement:
-swaymsg("exec planterette -v start org.codeberg.dnkl.foot")
+swaymsg("exec hpkg -v start org.codeberg.dnkl.foot")
 wait_for_window("hakurei@machine-foot")
 machine.send_chars("clear; wayland-info && touch /tmp/success-client\n")
-machine.wait_for_file("/tmp/hakurei.1000/tmpdir/2/success-client")
+machine.wait_for_file("/tmp/hakurei.0/tmpdir/2/success-client")
 collect_state_ui("app_wayland")
-check_state("foot", 13)
+check_state("foot", {"wayland": True, "dbus": True, "pulse": True})
 # Verify acl on XDG_RUNTIME_DIR:
 print(machine.succeed("getfacl --absolute-names --omit-header --numeric /run/user/1000 | grep 1000002"))
 machine.send_chars("exit\n")

cmd/hpkg/with.go

@@ -2,9 +2,9 @@ package main
 
 import (
 	"context"
-	"path"
 	"strings"
 
+	"hakurei.app/container"
 	"hakurei.app/container/seccomp"
 	"hakurei.app/hst"
 	"hakurei.app/internal"
@@ -18,8 +18,8 @@ func withNixDaemon(
 	mustRunAppDropShell(ctx, updateConfig(&hst.Config{
 		ID: app.ID,
 
-		Path: shellPath,
-		Args: []string{shellPath, "-lc", "rm -f /nix/var/nix/daemon-socket/socket && " +
+		Path: pathShell,
+		Args: []string{bash, "-lc", "rm -f /nix/var/nix/daemon-socket/socket && " +
 			// start nix-daemon
 			"nix-daemon --store / & " +
 			// wait for socket to appear
@@ -32,9 +32,8 @@ func withNixDaemon(
 		},
 
 		Username: "hakurei",
-		Shell:    shellPath,
-		Data:     pathSet.homeDir,
-		Dir:      path.Join("/data/data", app.ID),
+		Shell:    pathShell,
+		Home:     pathDataData.Append(app.ID),
 		ExtraPerms: []*hst.ExtraPermConfig{
 			{Path: dataHome, Execute: true},
 			{Ensure: true, Path: pathSet.baseDir, Read: true, Write: true, Execute: true},
@@ -45,37 +44,34 @@ func withNixDaemon(
 		Container: &hst.ContainerConfig{
 			Hostname:     formatHostname(app.Name) + "-" + action,
 			Userns:       true, // nix sandbox requires userns
-			Net:          net,
+			HostNet:      net,
 			SeccompFlags: seccomp.AllowMultiarch,
 			Tty:          dropShell,
-			Filesystem: []*hst.FilesystemConfig{
-				{Src: pathSet.nixPath, Dst: "/nix", Write: true, Must: true},
+			Filesystem: []hst.FilesystemConfigJSON{
+				{FilesystemConfig: &hst.FSBind{Target: container.AbsFHSEtc, Source: pathSet.cacheDir.Append("etc"), Special: true}},
+				{FilesystemConfig: &hst.FSBind{Source: pathSet.nixPath, Target: pathNix, Write: true}},
+				{FilesystemConfig: &hst.FSLink{Target: pathCurrentSystem, Linkname: app.CurrentSystem.String()}},
+				{FilesystemConfig: &hst.FSLink{Target: pathBin, Linkname: pathSwBin.String()}},
+				{FilesystemConfig: &hst.FSLink{Target: container.AbsFHSUsrBin, Linkname: pathSwBin.String()}},
+				{FilesystemConfig: &hst.FSBind{Target: pathDataData.Append(app.ID), Source: pathSet.homeDir, Write: true, Ensure: true}},
 			},
-			Link: [][2]string{
-				{app.CurrentSystem, "/run/current-system"},
-				{"/run/current-system/sw/bin", "/bin"},
-				{"/run/current-system/sw/bin", "/usr/bin"},
-			},
-			Etc:     path.Join(pathSet.cacheDir, "etc"),
-			AutoEtc: true,
 		},
 	}), dropShell, beforeFail)
 }
 
 func withCacheDir(
 	ctx context.Context,
-	action string, command []string, workDir string,
+	action string, command []string, workDir *container.Absolute,
 	app *appInfo, pathSet *appPathSet, dropShell bool, beforeFail func()) {
 	mustRunAppDropShell(ctx, &hst.Config{
 		ID: app.ID,
 
-		Path: shellPath,
-		Args: []string{shellPath, "-lc", strings.Join(command, " && ")},
+		Path: pathShell,
+		Args: []string{bash, "-lc", strings.Join(command, " && ")},
 
 		Username: "nixos",
-		Shell:    shellPath,
-		Data:     pathSet.cacheDir, // this also ensures cacheDir via shim
-		Dir:      path.Join("/data/data", app.ID, "cache"),
+		Shell:    pathShell,
+		Home:     pathDataData.Append(app.ID, "cache"),
 		ExtraPerms: []*hst.ExtraPermConfig{
 			{Path: dataHome, Execute: true},
 			{Ensure: true, Path: pathSet.baseDir, Read: true, Write: true, Execute: true},
@@ -88,24 +84,22 @@ func withCacheDir(
 			Hostname:     formatHostname(app.Name) + "-" + action,
 			SeccompFlags: seccomp.AllowMultiarch,
 			Tty:          dropShell,
-			Filesystem: []*hst.FilesystemConfig{
-				{Src: path.Join(workDir, "nix"), Dst: "/nix", Must: true},
-				{Src: workDir, Dst: path.Join(hst.Tmp, "bundle"), Must: true},
+			Filesystem: []hst.FilesystemConfigJSON{
+				{FilesystemConfig: &hst.FSBind{Target: container.AbsFHSEtc, Source: workDir.Append(container.FHSEtc), Special: true}},
+				{FilesystemConfig: &hst.FSBind{Source: workDir.Append("nix"), Target: pathNix}},
+				{FilesystemConfig: &hst.FSLink{Target: pathCurrentSystem, Linkname: app.CurrentSystem.String()}},
+				{FilesystemConfig: &hst.FSLink{Target: pathBin, Linkname: pathSwBin.String()}},
+				{FilesystemConfig: &hst.FSLink{Target: container.AbsFHSUsrBin, Linkname: pathSwBin.String()}},
+				{FilesystemConfig: &hst.FSBind{Source: workDir, Target: hst.AbsTmp.Append("bundle")}},
+				{FilesystemConfig: &hst.FSBind{Target: pathDataData.Append(app.ID, "cache"), Source: pathSet.cacheDir, Write: true, Ensure: true}},
 			},
-			Link: [][2]string{
-				{app.CurrentSystem, "/run/current-system"},
-				{"/run/current-system/sw/bin", "/bin"},
-				{"/run/current-system/sw/bin", "/usr/bin"},
-			},
-			Etc:     path.Join(workDir, "etc"),
-			AutoEtc: true,
 		},
 	}, dropShell, beforeFail)
 }
 
 func mustRunAppDropShell(ctx context.Context, config *hst.Config, dropShell bool, beforeFail func()) {
 	if dropShell {
-		config.Args = []string{shellPath, "-l"}
+		config.Args = []string{bash, "-l"}
 		mustRunApp(ctx, config, beforeFail)
 		beforeFail()
 		internal.Exit(0)

cmd/hsu/main.go

@@ -15,7 +15,7 @@ import (
 const (
 	hsuConfFile = "/etc/hsurc"
 	envShim     = "HAKUREI_SHIM"
-	envAID      = "HAKUREI_APP_ID"
+	envIdentity = "HAKUREI_IDENTITY"
 	envGroups   = "HAKUREI_GROUPS"
 
 	PR_SET_NO_NEW_PRIVS = 0x26
@@ -48,8 +48,8 @@ func main() {
 	}
 
 	// uid = 1000000 +
-	//   fid * 10000 +
-	//           aid
+	//    id * 10000 +
+	//      identity
 	uid := 1000000
 
 	// refuse to run if hsurc is not protected correctly
@@ -62,29 +62,25 @@ func main() {
 	}
 
 	// authenticate before accepting user input
+	var id int
 	if f, err := os.Open(hsuConfFile); err != nil {
 		log.Fatal(err)
-	} else if fid, ok := mustParseConfig(f, puid); !ok {
+	} else if v, ok := mustParseConfig(f, puid); !ok {
 		log.Fatalf("uid %d is not in the hsurc file", puid)
 	} else {
-		uid += fid * 10000
-	}
+		id = v
+		if err = f.Close(); err != nil {
+			log.Fatal(err)
+		}
 
-	// allowed aid range 0 to 9999
-	if as, ok := os.LookupEnv(envAID); !ok {
-		log.Fatal("HAKUREI_APP_ID not set")
-	} else if aid, err := parseUint32Fast(as); err != nil || aid < 0 || aid > 9999 {
-		log.Fatal("invalid aid")
-	} else {
-		uid += aid
+		uid += id * 10000
 	}
 
 	// pass through setup fd to shim
 	var shimSetupFd string
 	if s, ok := os.LookupEnv(envShim); !ok {
-		// hakurei requests target uid
-		// print resolved uid and exit
-		fmt.Print(uid)
+		// hakurei requests hsurc user id
+		fmt.Print(id)
 		os.Exit(0)
 	} else if len(s) != 1 || s[0] > '9' || s[0] < '3' {
 		log.Fatal("HAKUREI_SHIM holds an invalid value")
@@ -92,6 +88,15 @@ func main() {
 		shimSetupFd = s
 	}
 
+	// allowed identity range 0 to 9999
+	if as, ok := os.LookupEnv(envIdentity); !ok {
+		log.Fatal("HAKUREI_IDENTITY not set")
+	} else if identity, err := parseUint32Fast(as); err != nil || identity < 0 || identity > 9999 {
+		log.Fatal("invalid identity")
+	} else {
+		uid += identity
+	}
+
 	// supplementary groups
 	var suppGroups, suppCurrent []int
 

cmd/planterette/paths.go

@@ -1,101 +0,0 @@
-package main
-
-import (
-	"log"
-	"os"
-	"os/exec"
-	"path"
-	"strconv"
-	"sync/atomic"
-
-	"hakurei.app/hst"
-	"hakurei.app/internal/hlog"
-)
-
-var (
-	dataHome string
-)
-
-func init() {
-	// dataHome
-	if p, ok := os.LookupEnv("HAKUREI_DATA_HOME"); ok {
-		dataHome = p
-	} else {
-		dataHome = "/var/lib/hakurei/" + strconv.Itoa(os.Getuid())
-	}
-}
-
-func lookPath(file string) string {
-	if p, err := exec.LookPath(file); err != nil {
-		log.Fatalf("%s: command not found", file)
-		return ""
-	} else {
-		return p
-	}
-}
-
-var beforeRunFail = new(atomic.Pointer[func()])
-
-func mustRun(name string, arg ...string) {
-	hlog.Verbosef("spawning process: %q %q", name, arg)
-	cmd := exec.Command(name, arg...)
-	cmd.Stdin, cmd.Stdout, cmd.Stderr = os.Stdin, os.Stdout, os.Stderr
-	if err := cmd.Run(); err != nil {
-		if f := beforeRunFail.Swap(nil); f != nil {
-			(*f)()
-		}
-		log.Fatalf("%s: %v", name, err)
-	}
-}
-
-type appPathSet struct {
-	// ${dataHome}/${id}
-	baseDir string
-	// ${baseDir}/app
-	metaPath string
-	// ${baseDir}/files
-	homeDir string
-	// ${baseDir}/cache
-	cacheDir string
-	// ${baseDir}/cache/nix
-	nixPath string
-}
-
-func pathSetByApp(id string) *appPathSet {
-	pathSet := new(appPathSet)
-	pathSet.baseDir = path.Join(dataHome, id)
-	pathSet.metaPath = path.Join(pathSet.baseDir, "app")
-	pathSet.homeDir = path.Join(pathSet.baseDir, "files")
-	pathSet.cacheDir = path.Join(pathSet.baseDir, "cache")
-	pathSet.nixPath = path.Join(pathSet.cacheDir, "nix")
-	return pathSet
-}
-
-func appendGPUFilesystem(config *hst.Config) {
-	config.Container.Filesystem = append(config.Container.Filesystem, []*hst.FilesystemConfig{
-		// flatpak commit 763a686d874dd668f0236f911de00b80766ffe79
-		{Src: "/dev/dri", Device: true},
-		// mali
-		{Src: "/dev/mali", Device: true},
-		{Src: "/dev/mali0", Device: true},
-		{Src: "/dev/umplock", Device: true},
-		// nvidia
-		{Src: "/dev/nvidiactl", Device: true},
-		{Src: "/dev/nvidia-modeset", Device: true},
-		// nvidia OpenCL/CUDA
-		{Src: "/dev/nvidia-uvm", Device: true},
-		{Src: "/dev/nvidia-uvm-tools", Device: true},
-
-		// flatpak commit d2dff2875bb3b7e2cd92d8204088d743fd07f3ff
-		{Src: "/dev/nvidia0", Device: true}, {Src: "/dev/nvidia1", Device: true},
-		{Src: "/dev/nvidia2", Device: true}, {Src: "/dev/nvidia3", Device: true},
-		{Src: "/dev/nvidia4", Device: true}, {Src: "/dev/nvidia5", Device: true},
-		{Src: "/dev/nvidia6", Device: true}, {Src: "/dev/nvidia7", Device: true},
-		{Src: "/dev/nvidia8", Device: true}, {Src: "/dev/nvidia9", Device: true},
-		{Src: "/dev/nvidia10", Device: true}, {Src: "/dev/nvidia11", Device: true},
-		{Src: "/dev/nvidia12", Device: true}, {Src: "/dev/nvidia13", Device: true},
-		{Src: "/dev/nvidia14", Device: true}, {Src: "/dev/nvidia15", Device: true},
-		{Src: "/dev/nvidia16", Device: true}, {Src: "/dev/nvidia17", Device: true},
-		{Src: "/dev/nvidia18", Device: true}, {Src: "/dev/nvidia19", Device: true},
-	}...)
-}

container/absolute.go

@@ -0,0 +1,107 @@
+package container
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"path"
+	"slices"
+	"strings"
+	"syscall"
+)
+
+// AbsoluteError is returned by [NewAbs] and holds the invalid pathname.
+type AbsoluteError struct {
+	Pathname string
+}
+
+func (e *AbsoluteError) Error() string { return fmt.Sprintf("path %q is not absolute", e.Pathname) }
+func (e *AbsoluteError) Is(target error) bool {
+	var ce *AbsoluteError
+	if !errors.As(target, &ce) {
+		return errors.Is(target, syscall.EINVAL)
+	}
+	return *e == *ce
+}
+
+// Absolute holds a pathname checked to be absolute.
+type Absolute struct {
+	pathname string
+}
+
+// isAbs wraps [path.IsAbs] in case additional checks are added in the future.
+func isAbs(pathname string) bool { return path.IsAbs(pathname) }
+
+func (a *Absolute) String() string {
+	if a.pathname == zeroString {
+		panic("attempted use of zero Absolute")
+	}
+	return a.pathname
+}
+
+func (a *Absolute) Is(v *Absolute) bool {
+	if a == nil && v == nil {
+		return true
+	}
+	return a != nil && v != nil &&
+		a.pathname != zeroString && v.pathname != zeroString &&
+		a.pathname == v.pathname
+}
+
+// NewAbs checks pathname and returns a new [Absolute] if pathname is absolute.
+func NewAbs(pathname string) (*Absolute, error) {
+	if !isAbs(pathname) {
+		return nil, &AbsoluteError{pathname}
+	}
+	return &Absolute{pathname}, nil
+}
+
+// MustAbs calls [NewAbs] and panics on error.
+func MustAbs(pathname string) *Absolute {
+	if a, err := NewAbs(pathname); err != nil {
+		panic(err.Error())
+	} else {
+		return a
+	}
+}
+
+// Append calls [path.Join] with [Absolute] as the first element.
+func (a *Absolute) Append(elem ...string) *Absolute {
+	return &Absolute{path.Join(append([]string{a.String()}, elem...)...)}
+}
+
+// Dir calls [path.Dir] with [Absolute] as its argument.
+func (a *Absolute) Dir() *Absolute { return &Absolute{path.Dir(a.String())} }
+
+func (a *Absolute) GobEncode() ([]byte, error) { return []byte(a.String()), nil }
+func (a *Absolute) GobDecode(data []byte) error {
+	pathname := string(data)
+	if !isAbs(pathname) {
+		return &AbsoluteError{pathname}
+	}
+	a.pathname = pathname
+	return nil
+}
+
+func (a *Absolute) MarshalJSON() ([]byte, error) { return json.Marshal(a.String()) }
+func (a *Absolute) UnmarshalJSON(data []byte) error {
+	var pathname string
+	if err := json.Unmarshal(data, &pathname); err != nil {
+		return err
+	}
+	if !isAbs(pathname) {
+		return &AbsoluteError{pathname}
+	}
+	a.pathname = pathname
+	return nil
+}
+
+// SortAbs calls [slices.SortFunc] for a slice of [Absolute].
+func SortAbs(x []*Absolute) {
+	slices.SortFunc(x, func(a, b *Absolute) int { return strings.Compare(a.String(), b.String()) })
+}
+
+// CompactAbs calls [slices.CompactFunc] for a slice of [Absolute].
+func CompactAbs(s []*Absolute) []*Absolute {
+	return slices.CompactFunc(s, func(a *Absolute, b *Absolute) bool { return a.String() == b.String() })
+}

container/absolute_test.go

@@ -0,0 +1,348 @@
+package container
+
+import (
+	"bytes"
+	"encoding/gob"
+	"encoding/json"
+	"errors"
+	"reflect"
+	"strings"
+	"syscall"
+	"testing"
+)
+
+func TestAbsoluteError(t *testing.T) {
+	testCases := []struct {
+		name string
+
+		err error
+		cmp error
+		ok  bool
+	}{
+		{"EINVAL", new(AbsoluteError), syscall.EINVAL, true},
+		{"not EINVAL", new(AbsoluteError), syscall.EBADE, false},
+		{"ne val", new(AbsoluteError), &AbsoluteError{"etc"}, false},
+		{"equals", &AbsoluteError{"etc"}, &AbsoluteError{"etc"}, true},
+	}
+
+	for _, tc := range testCases {
+		if got := errors.Is(tc.err, tc.cmp); got != tc.ok {
+			t.Errorf("Is: %v, want %v", got, tc.ok)
+		}
+	}
+
+	t.Run("string", func(t *testing.T) {
+		want := `path "etc" is not absolute`
+		if got := (&AbsoluteError{"etc"}).Error(); got != want {
+			t.Errorf("Error: %q, want %q", got, want)
+		}
+	})
+}
+
+func TestNewAbs(t *testing.T) {
+	testCases := []struct {
+		name string
+
+		pathname string
+		want     *Absolute
+		wantErr  error
+	}{
+		{"good", "/etc", MustAbs("/etc"), nil},
+		{"not absolute", "etc", nil, &AbsoluteError{"etc"}},
+		{"zero", "", nil, &AbsoluteError{""}},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			got, err := NewAbs(tc.pathname)
+			if !reflect.DeepEqual(got, tc.want) {
+				t.Errorf("NewAbs: %#v, want %#v", got, tc.want)
+			}
+			if !errors.Is(err, tc.wantErr) {
+				t.Errorf("NewAbs: error = %v, want %v", err, tc.wantErr)
+			}
+		})
+	}
+
+	t.Run("must", func(t *testing.T) {
+		defer func() {
+			wantPanic := `path "etc" is not absolute`
+
+			if r := recover(); r != wantPanic {
+				t.Errorf("MustAbs: panic = %v; want %v", r, wantPanic)
+			}
+		}()
+
+		MustAbs("etc")
+	})
+}
+
+func TestAbsoluteString(t *testing.T) {
+	t.Run("passthrough", func(t *testing.T) {
+		pathname := "/etc"
+		if got := (&Absolute{pathname}).String(); got != pathname {
+			t.Errorf("String: %q, want %q", got, pathname)
+		}
+	})
+
+	t.Run("zero", func(t *testing.T) {
+		defer func() {
+			wantPanic := "attempted use of zero Absolute"
+
+			if r := recover(); r != wantPanic {
+				t.Errorf("String: panic = %v, want %v", r, wantPanic)
+			}
+		}()
+
+		panic(new(Absolute).String())
+	})
+}
+
+func TestAbsoluteIs(t *testing.T) {
+	testCases := []struct {
+		name string
+		a, v *Absolute
+		want bool
+	}{
+		{"nil", (*Absolute)(nil), (*Absolute)(nil), true},
+		{"nil a", (*Absolute)(nil), MustAbs("/"), false},
+		{"nil v", MustAbs("/"), (*Absolute)(nil), false},
+		{"zero", new(Absolute), new(Absolute), false},
+		{"zero a", new(Absolute), MustAbs("/"), false},
+		{"zero v", MustAbs("/"), new(Absolute), false},
+		{"equals", MustAbs("/"), MustAbs("/"), true},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := tc.a.Is(tc.v); got != tc.want {
+				t.Errorf("Is: %v, want %v", got, tc.want)
+			}
+		})
+	}
+}
+
+type sCheck struct {
+	Pathname *Absolute `json:"val"`
+	Magic    int       `json:"magic"`
+}
+
+func TestCodecAbsolute(t *testing.T) {
+	testCases := []struct {
+		name string
+		a    *Absolute
+
+		wantErr error
+
+		gob, sGob   string
+		json, sJson string
+	}{
+		{"nil", nil, nil,
+			"\x00", "\x00",
+			`null`, `{"val":null,"magic":3236757504}`},
+
+		{"good", MustAbs("/etc"),
+			nil,
+			"\t\x7f\x05\x01\x02\xff\x82\x00\x00\x00\b\xff\x80\x00\x04/etc",
+			",\xff\x83\x03\x01\x01\x06sCheck\x01\xff\x84\x00\x01\x02\x01\bPathname\x01\xff\x80\x00\x01\x05Magic\x01\x04\x00\x00\x00\t\x7f\x05\x01\x02\xff\x82\x00\x00\x00\x10\xff\x84\x01\x04/etc\x01\xfb\x01\x81\xda\x00\x00\x00",
+
+			`"/etc"`, `{"val":"/etc","magic":3236757504}`},
+		{"not absolute", nil,
+			&AbsoluteError{"etc"},
+			"\t\x7f\x05\x01\x02\xff\x82\x00\x00\x00\a\xff\x80\x00\x03etc",
+			",\xff\x83\x03\x01\x01\x06sCheck\x01\xff\x84\x00\x01\x02\x01\bPathname\x01\xff\x80\x00\x01\x05Magic\x01\x04\x00\x00\x00\t\x7f\x05\x01\x02\xff\x82\x00\x00\x00\x0f\xff\x84\x01\x03etc\x01\xfb\x01\x81\xda\x00\x00\x00",
+
+			`"etc"`, `{"val":"etc","magic":3236757504}`},
+		{"zero", nil,
+			new(AbsoluteError),
+			"\t\x7f\x05\x01\x02\xff\x82\x00\x00\x00\x04\xff\x80\x00\x00",
+			",\xff\x83\x03\x01\x01\x06sCheck\x01\xff\x84\x00\x01\x02\x01\bPathname\x01\xff\x80\x00\x01\x05Magic\x01\x04\x00\x00\x00\t\x7f\x05\x01\x02\xff\x82\x00\x00\x00\f\xff\x84\x01\x00\x01\xfb\x01\x81\xda\x00\x00\x00",
+			`""`, `{"val":"","magic":3236757504}`},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Run("gob", func(t *testing.T) {
+				if tc.gob == "\x00" && tc.sGob == "\x00" {
+					// these values mark the current test to skip gob
+					return
+				}
+
+				t.Run("encode", func(t *testing.T) {
+					// encode is unchecked
+					if errors.Is(tc.wantErr, syscall.EINVAL) {
+						return
+					}
+
+					{
+						buf := new(bytes.Buffer)
+						err := gob.NewEncoder(buf).Encode(tc.a)
+						if !errors.Is(err, tc.wantErr) {
+							t.Errorf("Encode: error = %v, want %v", err, tc.wantErr)
+						}
+						if tc.wantErr != nil {
+							goto checkSEncode
+						}
+						if buf.String() != tc.gob {
+							t.Errorf("Encode:\n%q\nwant:\n%q", buf.String(), tc.gob)
+						}
+					}
+
+				checkSEncode:
+					{
+						buf := new(bytes.Buffer)
+						err := gob.NewEncoder(buf).Encode(&sCheck{tc.a, syscall.MS_MGC_VAL})
+						if !errors.Is(err, tc.wantErr) {
+							t.Errorf("Encode: error = %v, want %v", err, tc.wantErr)
+						}
+						if tc.wantErr != nil {
+							return
+						}
+						if buf.String() != tc.sGob {
+							t.Errorf("Encode:\n%q\nwant:\n%q", buf.String(), tc.sGob)
+						}
+					}
+				})
+
+				t.Run("decode", func(t *testing.T) {
+					{
+						var gotA *Absolute
+						err := gob.NewDecoder(strings.NewReader(tc.gob)).Decode(&gotA)
+						if !errors.Is(err, tc.wantErr) {
+							t.Errorf("Decode: error = %v, want %v", err, tc.wantErr)
+						}
+						if tc.wantErr != nil {
+							goto checkSDecode
+						}
+						if !reflect.DeepEqual(tc.a, gotA) {
+							t.Errorf("Decode: %#v, want %#v", tc.a, gotA)
+						}
+					}
+
+				checkSDecode:
+					{
+						var gotSCheck sCheck
+						err := gob.NewDecoder(strings.NewReader(tc.sGob)).Decode(&gotSCheck)
+						if !errors.Is(err, tc.wantErr) {
+							t.Errorf("Decode: error = %v, want %v", err, tc.wantErr)
+						}
+						if tc.wantErr != nil {
+							return
+						}
+						want := sCheck{tc.a, syscall.MS_MGC_VAL}
+						if !reflect.DeepEqual(gotSCheck, want) {
+							t.Errorf("Decode: %#v, want %#v", gotSCheck, want)
+						}
+					}
+				})
+
+			})
+
+			t.Run("json", func(t *testing.T) {
+				t.Run("marshal", func(t *testing.T) {
+					// marshal is unchecked
+					if errors.Is(tc.wantErr, syscall.EINVAL) {
+						return
+					}
+
+					{
+						d, err := json.Marshal(tc.a)
+						if !errors.Is(err, tc.wantErr) {
+							t.Errorf("Marshal: error = %v, want %v", err, tc.wantErr)
+						}
+						if tc.wantErr != nil {
+							goto checkSMarshal
+						}
+						if string(d) != tc.json {
+							t.Errorf("Marshal:\n%s\nwant:\n%s", string(d), tc.json)
+						}
+					}
+
+				checkSMarshal:
+					{
+						d, err := json.Marshal(&sCheck{tc.a, syscall.MS_MGC_VAL})
+						if !errors.Is(err, tc.wantErr) {
+							t.Errorf("Marshal: error = %v, want %v", err, tc.wantErr)
+						}
+						if tc.wantErr != nil {
+							return
+						}
+						if string(d) != tc.sJson {
+							t.Errorf("Marshal:\n%s\nwant:\n%s", string(d), tc.sJson)
+						}
+					}
+				})
+
+				t.Run("unmarshal", func(t *testing.T) {
+					{
+						var gotA *Absolute
+						err := json.Unmarshal([]byte(tc.json), &gotA)
+						if !errors.Is(err, tc.wantErr) {
+							t.Errorf("Unmarshal: error = %v, want %v", err, tc.wantErr)
+						}
+						if tc.wantErr != nil {
+							goto checkSUnmarshal
+						}
+						if !reflect.DeepEqual(tc.a, gotA) {
+							t.Errorf("Unmarshal: %#v, want %#v", tc.a, gotA)
+						}
+					}
+
+				checkSUnmarshal:
+					{
+						var gotSCheck sCheck
+						err := json.Unmarshal([]byte(tc.sJson), &gotSCheck)
+						if !errors.Is(err, tc.wantErr) {
+							t.Errorf("Unmarshal: error = %v, want %v", err, tc.wantErr)
+						}
+						if tc.wantErr != nil {
+							return
+						}
+						want := sCheck{tc.a, syscall.MS_MGC_VAL}
+						if !reflect.DeepEqual(gotSCheck, want) {
+							t.Errorf("Unmarshal: %#v, want %#v", gotSCheck, want)
+						}
+					}
+				})
+			})
+		})
+	}
+
+	t.Run("json passthrough", func(t *testing.T) {
+		wantErr := "invalid character ':' looking for beginning of value"
+		if err := new(Absolute).UnmarshalJSON([]byte(":3")); err == nil || err.Error() != wantErr {
+			t.Errorf("UnmarshalJSON: error = %v, want %s", err, wantErr)
+		}
+	})
+}
+
+func TestAbsoluteWrap(t *testing.T) {
+	t.Run("join", func(t *testing.T) {
+		want := "/etc/nix/nix.conf"
+		if got := MustAbs("/etc").Append("nix", "nix.conf"); got.String() != want {
+			t.Errorf("Append: %q, want %q", got, want)
+		}
+	})
+
+	t.Run("dir", func(t *testing.T) {
+		want := "/"
+		if got := MustAbs("/etc").Dir(); got.String() != want {
+			t.Errorf("Dir: %q, want %q", got, want)
+		}
+	})
+
+	t.Run("sort", func(t *testing.T) {
+		want := []*Absolute{MustAbs("/etc"), MustAbs("/proc"), MustAbs("/sys")}
+		got := []*Absolute{MustAbs("/proc"), MustAbs("/sys"), MustAbs("/etc")}
+		SortAbs(got)
+		if !reflect.DeepEqual(got, want) {
+			t.Errorf("SortAbs: %#v, want %#v", got, want)
+		}
+	})
+
+	t.Run("compact", func(t *testing.T) {
+		want := []*Absolute{MustAbs("/etc"), MustAbs("/proc"), MustAbs("/sys")}
+		if got := CompactAbs([]*Absolute{MustAbs("/etc"), MustAbs("/proc"), MustAbs("/proc"), MustAbs("/sys")}); !reflect.DeepEqual(got, want) {
+			t.Errorf("CompactAbs: %#v, want %#v", got, want)
+		}
+	})
+}

container/autoetc.go

@@ -0,0 +1,68 @@
+package container
+
+import (
+	"encoding/gob"
+	"fmt"
+)
+
+func init() { gob.Register(new(AutoEtcOp)) }
+
+// Etc appends an [Op] that expands host /etc into a toplevel symlink mirror with /etc semantics.
+// This is not a generic setup op. It is implemented here to reduce ipc overhead.
+func (f *Ops) Etc(host *Absolute, prefix string) *Ops {
+	e := &AutoEtcOp{prefix}
+	f.Mkdir(AbsFHSEtc, 0755)
+	f.Bind(host, e.hostPath(), 0)
+	*f = append(*f, e)
+	return f
+}
+
+type AutoEtcOp struct{ Prefix string }
+
+func (e *AutoEtcOp) Valid() bool                                { return e != nil }
+func (e *AutoEtcOp) early(*setupState, syscallDispatcher) error { return nil }
+func (e *AutoEtcOp) apply(state *setupState, k syscallDispatcher) error {
+	if state.nonrepeatable&nrAutoEtc != 0 {
+		return OpRepeatError("autoetc")
+	}
+	state.nonrepeatable |= nrAutoEtc
+
+	const target = sysrootPath + FHSEtc
+	rel := e.hostRel() + "/"
+
+	if err := k.mkdirAll(target, 0755); err != nil {
+		return err
+	}
+	if d, err := k.readdir(toSysroot(e.hostPath().String())); err != nil {
+		return err
+	} else {
+		for _, ent := range d {
+			n := ent.Name()
+			switch n {
+			case ".host", "passwd", "group":
+
+			case "mtab":
+				if err = k.symlink(FHSProc+"mounts", target+n); err != nil {
+					return err
+				}
+
+			default:
+				if err = k.symlink(rel+n, target+n); err != nil {
+					return err
+				}
+			}
+		}
+	}
+
+	return nil
+}
+
+func (e *AutoEtcOp) hostPath() *Absolute { return AbsFHSEtc.Append(e.hostRel()) }
+func (e *AutoEtcOp) hostRel() string     { return ".host/" + e.Prefix }
+
+func (e *AutoEtcOp) Is(op Op) bool {
+	ve, ok := op.(*AutoEtcOp)
+	return ok && e.Valid() && ve.Valid() && *e == *ve
+}
+func (*AutoEtcOp) prefix() (string, bool) { return "setting up", true }
+func (e *AutoEtcOp) String() string       { return fmt.Sprintf("auto etc %s", e.Prefix) }

container/autoetc_test.go

@@ -0,0 +1,292 @@
+package container
+
+import (
+	"errors"
+	"os"
+	"testing"
+
+	"hakurei.app/container/stub"
+)
+
+func TestAutoEtcOp(t *testing.T) {
+	t.Run("nonrepeatable", func(t *testing.T) {
+		wantErr := OpRepeatError("autoetc")
+		if err := (&AutoEtcOp{Prefix: "81ceabb30d37bbdb3868004629cb84e9"}).apply(&setupState{nonrepeatable: nrAutoEtc}, nil); !errors.Is(err, wantErr) {
+			t.Errorf("apply: error = %v, want %v", err, wantErr)
+		}
+	})
+
+	checkOpBehaviour(t, []opBehaviourTestCase{
+		{"mkdirAll", new(Params), &AutoEtcOp{
+			Prefix: "81ceabb30d37bbdb3868004629cb84e9",
+		}, nil, nil, []stub.Call{
+			call("mkdirAll", stub.ExpectArgs{"/sysroot/etc/", os.FileMode(0755)}, nil, stub.UniqueError(3)),
+		}, stub.UniqueError(3)},
+
+		{"readdir", new(Params), &AutoEtcOp{
+			Prefix: "81ceabb30d37bbdb3868004629cb84e9",
+		}, nil, nil, []stub.Call{
+			call("mkdirAll", stub.ExpectArgs{"/sysroot/etc/", os.FileMode(0755)}, nil, nil),
+			call("readdir", stub.ExpectArgs{"/sysroot/etc/.host/81ceabb30d37bbdb3868004629cb84e9"}, stubDir(), stub.UniqueError(2)),
+		}, stub.UniqueError(2)},
+
+		{"symlink", new(Params), &AutoEtcOp{
+			Prefix: "81ceabb30d37bbdb3868004629cb84e9",
+		}, nil, nil, []stub.Call{
+			call("mkdirAll", stub.ExpectArgs{"/sysroot/etc/", os.FileMode(0755)}, nil, nil),
+			call("readdir", stub.ExpectArgs{"/sysroot/etc/.host/81ceabb30d37bbdb3868004629cb84e9"}, stubDir(".host",
+				"alsa", "bash_logout", "bashrc", "binfmt.d", "dbus-1", "default", "dhcpcd.exit-hook", "fonts",
+				"fstab", "fuse.conf", "group", "host.conf", "hostname", "hosts", "hsurc", "inputrc", "issue", "kbd",
+				"locale.conf", "login.defs", "lsb-release", "lvm", "machine-id", "man_db.conf", "mdadm.conf",
+				"modprobe.d", "modules-load.d", "mtab", "nanorc", "netgroup", "nix", "nixos", "NIXOS", "nscd.conf",
+				"nsswitch.conf", "os-release", "pam", "pam.d", "passwd", "pipewire", "pki", "polkit-1", "profile",
+				"protocols", "resolv.conf", "resolvconf.conf", "rpc", "services", "set-environment", "shadow", "shells",
+				"ssh", "ssl", "static", "subgid", "subuid", "sudoers", "sway", "sysctl.d", "systemd", "terminfo",
+				"tmpfiles.d", "udev", "vconsole.conf", "X11", "xdg", "zoneinfo"), nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/alsa", "/sysroot/etc/alsa"}, nil, stub.UniqueError(1)),
+		}, stub.UniqueError(1)},
+
+		{"symlink mtab", new(Params), &AutoEtcOp{
+			Prefix: "81ceabb30d37bbdb3868004629cb84e9",
+		}, nil, nil, []stub.Call{
+			call("mkdirAll", stub.ExpectArgs{"/sysroot/etc/", os.FileMode(0755)}, nil, nil),
+			call("readdir", stub.ExpectArgs{"/sysroot/etc/.host/81ceabb30d37bbdb3868004629cb84e9"}, stubDir(".host",
+				"alsa", "bash_logout", "bashrc", "binfmt.d", "dbus-1", "default", "dhcpcd.exit-hook", "fonts",
+				"fstab", "fuse.conf", "group", "host.conf", "hostname", "hosts", "hsurc", "inputrc", "issue", "kbd",
+				"locale.conf", "login.defs", "lsb-release", "lvm", "machine-id", "man_db.conf", "mdadm.conf",
+				"modprobe.d", "modules-load.d", "mtab", "nanorc", "netgroup", "nix", "nixos", "NIXOS", "nscd.conf",
+				"nsswitch.conf", "os-release", "pam", "pam.d", "passwd", "pipewire", "pki", "polkit-1", "profile",
+				"protocols", "resolv.conf", "resolvconf.conf", "rpc", "services", "set-environment", "shadow", "shells",
+				"ssh", "ssl", "static", "subgid", "subuid", "sudoers", "sway", "sysctl.d", "systemd", "terminfo",
+				"tmpfiles.d", "udev", "vconsole.conf", "X11", "xdg", "zoneinfo"), nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/alsa", "/sysroot/etc/alsa"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/bash_logout", "/sysroot/etc/bash_logout"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/bashrc", "/sysroot/etc/bashrc"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/binfmt.d", "/sysroot/etc/binfmt.d"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/dbus-1", "/sysroot/etc/dbus-1"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/default", "/sysroot/etc/default"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/dhcpcd.exit-hook", "/sysroot/etc/dhcpcd.exit-hook"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/fonts", "/sysroot/etc/fonts"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/fstab", "/sysroot/etc/fstab"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/fuse.conf", "/sysroot/etc/fuse.conf"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/host.conf", "/sysroot/etc/host.conf"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/hostname", "/sysroot/etc/hostname"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/hosts", "/sysroot/etc/hosts"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/hsurc", "/sysroot/etc/hsurc"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/inputrc", "/sysroot/etc/inputrc"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/issue", "/sysroot/etc/issue"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/kbd", "/sysroot/etc/kbd"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/locale.conf", "/sysroot/etc/locale.conf"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/login.defs", "/sysroot/etc/login.defs"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/lsb-release", "/sysroot/etc/lsb-release"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/lvm", "/sysroot/etc/lvm"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/machine-id", "/sysroot/etc/machine-id"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/man_db.conf", "/sysroot/etc/man_db.conf"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/mdadm.conf", "/sysroot/etc/mdadm.conf"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/modprobe.d", "/sysroot/etc/modprobe.d"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/modules-load.d", "/sysroot/etc/modules-load.d"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/mounts", "/sysroot/etc/mtab"}, nil, stub.UniqueError(0)),
+		}, stub.UniqueError(0)},
+
+		{"success nested", new(Params), &AutoEtcOp{
+			Prefix: "81ceabb30d37bbdb3868004629cb84e9",
+		}, nil, nil, []stub.Call{
+			call("mkdirAll", stub.ExpectArgs{"/sysroot/etc/", os.FileMode(0755)}, nil, nil),
+			call("readdir", stub.ExpectArgs{"/sysroot/etc/.host/81ceabb30d37bbdb3868004629cb84e9"}, stubDir(".host",
+				"alsa", "bash_logout", "bashrc", "binfmt.d", "dbus-1", "default", "dhcpcd.exit-hook", "fonts",
+				"fstab", "fuse.conf", "group", "host.conf", "hostname", "hosts", "hsurc", "inputrc", "issue", "kbd",
+				"locale.conf", "login.defs", "lsb-release", "lvm", "machine-id", "man_db.conf", "mdadm.conf",
+				"modprobe.d", "modules-load.d", "mtab", "nanorc", "netgroup", "nix", "nixos", "NIXOS", "nscd.conf",
+				"nsswitch.conf", "os-release", "pam", "pam.d", "passwd", "pipewire", "pki", "polkit-1", "profile",
+				"protocols", "resolv.conf", "resolvconf.conf", "rpc", "services", "set-environment", "shadow", "shells",
+				"ssh", "ssl", "static", "subgid", "subuid", "sudoers", "sway", "sysctl.d", "systemd", "terminfo",
+				"tmpfiles.d", "udev", "vconsole.conf", "X11", "xdg", "zoneinfo"), nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/alsa", "/sysroot/etc/alsa"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/bash_logout", "/sysroot/etc/bash_logout"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/bashrc", "/sysroot/etc/bashrc"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/binfmt.d", "/sysroot/etc/binfmt.d"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/dbus-1", "/sysroot/etc/dbus-1"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/default", "/sysroot/etc/default"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/dhcpcd.exit-hook", "/sysroot/etc/dhcpcd.exit-hook"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/fonts", "/sysroot/etc/fonts"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/fstab", "/sysroot/etc/fstab"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/fuse.conf", "/sysroot/etc/fuse.conf"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/host.conf", "/sysroot/etc/host.conf"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/hostname", "/sysroot/etc/hostname"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/hosts", "/sysroot/etc/hosts"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/hsurc", "/sysroot/etc/hsurc"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/inputrc", "/sysroot/etc/inputrc"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/issue", "/sysroot/etc/issue"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/kbd", "/sysroot/etc/kbd"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/locale.conf", "/sysroot/etc/locale.conf"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/login.defs", "/sysroot/etc/login.defs"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/lsb-release", "/sysroot/etc/lsb-release"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/lvm", "/sysroot/etc/lvm"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/machine-id", "/sysroot/etc/machine-id"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/man_db.conf", "/sysroot/etc/man_db.conf"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/mdadm.conf", "/sysroot/etc/mdadm.conf"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/modprobe.d", "/sysroot/etc/modprobe.d"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/modules-load.d", "/sysroot/etc/modules-load.d"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/mounts", "/sysroot/etc/mtab"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/nanorc", "/sysroot/etc/nanorc"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/netgroup", "/sysroot/etc/netgroup"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/nix", "/sysroot/etc/nix"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/nixos", "/sysroot/etc/nixos"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/NIXOS", "/sysroot/etc/NIXOS"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/nscd.conf", "/sysroot/etc/nscd.conf"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/nsswitch.conf", "/sysroot/etc/nsswitch.conf"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/os-release", "/sysroot/etc/os-release"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/pam", "/sysroot/etc/pam"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/pam.d", "/sysroot/etc/pam.d"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/pipewire", "/sysroot/etc/pipewire"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/pki", "/sysroot/etc/pki"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/polkit-1", "/sysroot/etc/polkit-1"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/profile", "/sysroot/etc/profile"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/protocols", "/sysroot/etc/protocols"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/resolv.conf", "/sysroot/etc/resolv.conf"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/resolvconf.conf", "/sysroot/etc/resolvconf.conf"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/rpc", "/sysroot/etc/rpc"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/services", "/sysroot/etc/services"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/set-environment", "/sysroot/etc/set-environment"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/shadow", "/sysroot/etc/shadow"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/shells", "/sysroot/etc/shells"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/ssh", "/sysroot/etc/ssh"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/ssl", "/sysroot/etc/ssl"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/static", "/sysroot/etc/static"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/subgid", "/sysroot/etc/subgid"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/subuid", "/sysroot/etc/subuid"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/sudoers", "/sysroot/etc/sudoers"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/sway", "/sysroot/etc/sway"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/sysctl.d", "/sysroot/etc/sysctl.d"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/systemd", "/sysroot/etc/systemd"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/terminfo", "/sysroot/etc/terminfo"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/tmpfiles.d", "/sysroot/etc/tmpfiles.d"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/udev", "/sysroot/etc/udev"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/vconsole.conf", "/sysroot/etc/vconsole.conf"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/X11", "/sysroot/etc/X11"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/xdg", "/sysroot/etc/xdg"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/zoneinfo", "/sysroot/etc/zoneinfo"}, nil, nil),
+		}, nil},
+
+		{"success", new(Params), &AutoEtcOp{
+			Prefix: "81ceabb30d37bbdb3868004629cb84e9",
+		}, nil, nil, []stub.Call{
+			call("mkdirAll", stub.ExpectArgs{"/sysroot/etc/", os.FileMode(0755)}, nil, nil),
+			call("readdir", stub.ExpectArgs{"/sysroot/etc/.host/81ceabb30d37bbdb3868004629cb84e9"}, stubDir(
+				"alsa", "bash_logout", "bashrc", "binfmt.d", "dbus-1", "default", "dhcpcd.exit-hook", "fonts",
+				"fstab", "fuse.conf", "group", "host.conf", "hostname", "hosts", "hsurc", "inputrc", "issue", "kbd",
+				"locale.conf", "login.defs", "lsb-release", "lvm", "machine-id", "man_db.conf", "mdadm.conf",
+				"modprobe.d", "modules-load.d", "mtab", "nanorc", "netgroup", "nix", "nixos", "NIXOS", "nscd.conf",
+				"nsswitch.conf", "os-release", "pam", "pam.d", "passwd", "pipewire", "pki", "polkit-1", "profile",
+				"protocols", "resolv.conf", "resolvconf.conf", "rpc", "services", "set-environment", "shadow", "shells",
+				"ssh", "ssl", "static", "subgid", "subuid", "sudoers", "sway", "sysctl.d", "systemd", "terminfo",
+				"tmpfiles.d", "udev", "vconsole.conf", "X11", "xdg", "zoneinfo"), nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/alsa", "/sysroot/etc/alsa"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/bash_logout", "/sysroot/etc/bash_logout"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/bashrc", "/sysroot/etc/bashrc"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/binfmt.d", "/sysroot/etc/binfmt.d"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/dbus-1", "/sysroot/etc/dbus-1"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/default", "/sysroot/etc/default"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/dhcpcd.exit-hook", "/sysroot/etc/dhcpcd.exit-hook"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/fonts", "/sysroot/etc/fonts"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/fstab", "/sysroot/etc/fstab"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/fuse.conf", "/sysroot/etc/fuse.conf"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/host.conf", "/sysroot/etc/host.conf"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/hostname", "/sysroot/etc/hostname"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/hosts", "/sysroot/etc/hosts"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/hsurc", "/sysroot/etc/hsurc"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/inputrc", "/sysroot/etc/inputrc"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/issue", "/sysroot/etc/issue"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/kbd", "/sysroot/etc/kbd"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/locale.conf", "/sysroot/etc/locale.conf"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/login.defs", "/sysroot/etc/login.defs"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/lsb-release", "/sysroot/etc/lsb-release"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/lvm", "/sysroot/etc/lvm"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/machine-id", "/sysroot/etc/machine-id"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/man_db.conf", "/sysroot/etc/man_db.conf"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/mdadm.conf", "/sysroot/etc/mdadm.conf"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/modprobe.d", "/sysroot/etc/modprobe.d"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/modules-load.d", "/sysroot/etc/modules-load.d"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/mounts", "/sysroot/etc/mtab"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/nanorc", "/sysroot/etc/nanorc"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/netgroup", "/sysroot/etc/netgroup"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/nix", "/sysroot/etc/nix"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/nixos", "/sysroot/etc/nixos"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/NIXOS", "/sysroot/etc/NIXOS"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/nscd.conf", "/sysroot/etc/nscd.conf"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/nsswitch.conf", "/sysroot/etc/nsswitch.conf"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/os-release", "/sysroot/etc/os-release"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/pam", "/sysroot/etc/pam"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/pam.d", "/sysroot/etc/pam.d"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/pipewire", "/sysroot/etc/pipewire"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/pki", "/sysroot/etc/pki"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/polkit-1", "/sysroot/etc/polkit-1"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/profile", "/sysroot/etc/profile"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/protocols", "/sysroot/etc/protocols"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/resolv.conf", "/sysroot/etc/resolv.conf"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/resolvconf.conf", "/sysroot/etc/resolvconf.conf"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/rpc", "/sysroot/etc/rpc"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/services", "/sysroot/etc/services"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/set-environment", "/sysroot/etc/set-environment"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/shadow", "/sysroot/etc/shadow"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/shells", "/sysroot/etc/shells"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/ssh", "/sysroot/etc/ssh"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/ssl", "/sysroot/etc/ssl"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/static", "/sysroot/etc/static"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/subgid", "/sysroot/etc/subgid"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/subuid", "/sysroot/etc/subuid"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/sudoers", "/sysroot/etc/sudoers"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/sway", "/sysroot/etc/sway"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/sysctl.d", "/sysroot/etc/sysctl.d"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/systemd", "/sysroot/etc/systemd"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/terminfo", "/sysroot/etc/terminfo"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/tmpfiles.d", "/sysroot/etc/tmpfiles.d"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/udev", "/sysroot/etc/udev"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/vconsole.conf", "/sysroot/etc/vconsole.conf"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/X11", "/sysroot/etc/X11"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/xdg", "/sysroot/etc/xdg"}, nil, nil),
+			call("symlink", stub.ExpectArgs{".host/81ceabb30d37bbdb3868004629cb84e9/zoneinfo", "/sysroot/etc/zoneinfo"}, nil, nil),
+		}, nil},
+	})
+
+	checkOpsValid(t, []opValidTestCase{
+		{"nil", (*AutoEtcOp)(nil), false},
+		{"zero", new(AutoEtcOp), true},
+		{"populated", &AutoEtcOp{Prefix: ":3"}, true},
+	})
+
+	checkOpsBuilder(t, []opsBuilderTestCase{
+		{"pd", new(Ops).Etc(MustAbs("/etc/"), "048090b6ed8f9ebb10e275ff5d8c0659"), Ops{
+			&MkdirOp{Path: MustAbs("/etc/"), Perm: 0755},
+			&BindMountOp{
+				Source: MustAbs("/etc/"),
+				Target: MustAbs("/etc/.host/048090b6ed8f9ebb10e275ff5d8c0659"),
+			},
+			&AutoEtcOp{Prefix: "048090b6ed8f9ebb10e275ff5d8c0659"},
+		}},
+	})
+
+	checkOpIs(t, []opIsTestCase{
+		{"zero", new(AutoEtcOp), new(AutoEtcOp), true},
+		{"differs", &AutoEtcOp{Prefix: "\x00"}, &AutoEtcOp{":3"}, false},
+		{"equals", &AutoEtcOp{Prefix: ":3"}, &AutoEtcOp{":3"}, true},
+	})
+
+	checkOpMeta(t, []opMetaTestCase{
+		{"etc", &AutoEtcOp{
+			Prefix: ":3",
+		}, "setting up", "auto etc :3"},
+	})
+
+	t.Run("host path rel", func(t *testing.T) {
+		op := &AutoEtcOp{Prefix: "048090b6ed8f9ebb10e275ff5d8c0659"}
+		wantHostPath := "/etc/.host/048090b6ed8f9ebb10e275ff5d8c0659"
+		wantHostRel := ".host/048090b6ed8f9ebb10e275ff5d8c0659"
+		if got := op.hostPath(); got.String() != wantHostPath {
+			t.Errorf("hostPath: %q, want %q", got, wantHostPath)
+		}
+		if got := op.hostRel(); got != wantHostRel {
+			t.Errorf("hostRel: %q, want %q", got, wantHostRel)
+		}
+	})
+}

container/autoroot.go

@@ -0,0 +1,93 @@
+package container
+
+import (
+	"encoding/gob"
+	"fmt"
+)
+
+func init() { gob.Register(new(AutoRootOp)) }
+
+// Root appends an [Op] that expands a directory into a toplevel bind mount mirror on container root.
+// This is not a generic setup op. It is implemented here to reduce ipc overhead.
+func (f *Ops) Root(host *Absolute, flags int) *Ops {
+	*f = append(*f, &AutoRootOp{host, flags, nil})
+	return f
+}
+
+type AutoRootOp struct {
+	Host *Absolute
+	// passed through to bindMount
+	Flags int
+
+	// obtained during early;
+	// these wrap the underlying Op because BindMountOp is relatively complex,
+	// so duplicating that code would be unwise
+	resolved []*BindMountOp
+}
+
+func (r *AutoRootOp) Valid() bool { return r != nil && r.Host != nil }
+
+func (r *AutoRootOp) early(state *setupState, k syscallDispatcher) error {
+	if d, err := k.readdir(r.Host.String()); err != nil {
+		return err
+	} else {
+		r.resolved = make([]*BindMountOp, 0, len(d))
+		for _, ent := range d {
+			name := ent.Name()
+			if IsAutoRootBindable(name) {
+				// careful: the Valid method is skipped, make sure this is always valid
+				op := &BindMountOp{
+					Source: r.Host.Append(name),
+					Target: AbsFHSRoot.Append(name),
+					Flags:  r.Flags,
+				}
+				if err = op.early(state, k); err != nil {
+					return err
+				}
+				r.resolved = append(r.resolved, op)
+			}
+		}
+		return nil
+	}
+}
+
+func (r *AutoRootOp) apply(state *setupState, k syscallDispatcher) error {
+	if state.nonrepeatable&nrAutoRoot != 0 {
+		return OpRepeatError("autoroot")
+	}
+	state.nonrepeatable |= nrAutoRoot
+
+	for _, op := range r.resolved {
+		// these are exclusively BindMountOp, do not attempt to print identifying message
+		if err := op.apply(state, k); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (r *AutoRootOp) Is(op Op) bool {
+	vr, ok := op.(*AutoRootOp)
+	return ok && r.Valid() && vr.Valid() &&
+		r.Host.Is(vr.Host) &&
+		r.Flags == vr.Flags
+}
+func (*AutoRootOp) prefix() (string, bool) { return "setting up", true }
+func (r *AutoRootOp) String() string {
+	return fmt.Sprintf("auto root %q flags %#x", r.Host, r.Flags)
+}
+
+// IsAutoRootBindable returns whether a dir entry name is selected for AutoRoot.
+func IsAutoRootBindable(name string) bool {
+	switch name {
+	case "proc", "dev", "tmp", "mnt", "etc":
+
+	case "": // guard against accidentally binding /
+		// should be unreachable
+		msg.Verbose("got unexpected root entry")
+
+	default:
+		return true
+	}
+	return false
+}

container/autoroot_test.go

@@ -0,0 +1,200 @@
+package container
+
+import (
+	"errors"
+	"os"
+	"testing"
+
+	"hakurei.app/container/stub"
+)
+
+func TestAutoRootOp(t *testing.T) {
+	t.Run("nonrepeatable", func(t *testing.T) {
+		wantErr := OpRepeatError("autoroot")
+		if err := new(AutoRootOp).apply(&setupState{nonrepeatable: nrAutoRoot}, nil); !errors.Is(err, wantErr) {
+			t.Errorf("apply: error = %v, want %v", err, wantErr)
+		}
+	})
+
+	checkOpBehaviour(t, []opBehaviourTestCase{
+		{"readdir", &Params{ParentPerm: 0750}, &AutoRootOp{
+			Host:  MustAbs("/"),
+			Flags: BindWritable,
+		}, []stub.Call{
+			call("readdir", stub.ExpectArgs{"/"}, stubDir(), stub.UniqueError(2)),
+		}, stub.UniqueError(2), nil, nil},
+
+		{"early", &Params{ParentPerm: 0750}, &AutoRootOp{
+			Host:  MustAbs("/"),
+			Flags: BindWritable,
+		}, []stub.Call{
+			call("readdir", stub.ExpectArgs{"/"}, stubDir("bin", "dev", "etc", "home", "lib64",
+				"lost+found", "mnt", "nix", "proc", "root", "run", "srv", "sys", "tmp", "usr", "var"), nil),
+			call("evalSymlinks", stub.ExpectArgs{"/bin"}, "", stub.UniqueError(1)),
+		}, stub.UniqueError(1), nil, nil},
+
+		{"apply", &Params{ParentPerm: 0750}, &AutoRootOp{
+			Host:  MustAbs("/"),
+			Flags: BindWritable,
+		}, []stub.Call{
+			call("readdir", stub.ExpectArgs{"/"}, stubDir("bin", "dev", "etc", "home", "lib64",
+				"lost+found", "mnt", "nix", "proc", "root", "run", "srv", "sys", "tmp", "usr", "var"), nil),
+			call("evalSymlinks", stub.ExpectArgs{"/bin"}, "/usr/bin", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/home"}, "/home", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/lib64"}, "/lib64", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/lost+found"}, "/lost+found", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/nix"}, "/nix", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/root"}, "/root", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/run"}, "/run", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/srv"}, "/srv", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/sys"}, "/sys", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/usr"}, "/usr", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/var"}, "/var", nil),
+		}, nil, []stub.Call{
+			call("stat", stub.ExpectArgs{"/host/usr/bin"}, isDirFi(false), stub.UniqueError(0)),
+		}, stub.UniqueError(0)},
+
+		{"success pd", &Params{ParentPerm: 0750}, &AutoRootOp{
+			Host:  MustAbs("/"),
+			Flags: BindWritable,
+		}, []stub.Call{
+			call("readdir", stub.ExpectArgs{"/"}, stubDir("bin", "dev", "etc", "home", "lib64",
+				"lost+found", "mnt", "nix", "proc", "root", "run", "srv", "sys", "tmp", "usr", "var"), nil),
+			call("evalSymlinks", stub.ExpectArgs{"/bin"}, "/usr/bin", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/home"}, "/home", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/lib64"}, "/lib64", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/lost+found"}, "/lost+found", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/nix"}, "/nix", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/root"}, "/root", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/run"}, "/run", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/srv"}, "/srv", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/sys"}, "/sys", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/usr"}, "/usr", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/var"}, "/var", nil),
+		}, nil, []stub.Call{
+			call("stat", stub.ExpectArgs{"/host/usr/bin"}, isDirFi(true), nil), call("mkdirAll", stub.ExpectArgs{"/sysroot/bin", os.FileMode(0700)}, nil, nil), call("verbosef", stub.ExpectArgs{"mounting %q on %q flags %#x", []any{"/host/usr/bin", "/sysroot/bin", uintptr(0x4004)}}, nil, nil), call("bindMount", stub.ExpectArgs{"/host/usr/bin", "/sysroot/bin", uintptr(0x4004), false}, nil, nil),
+			call("stat", stub.ExpectArgs{"/host/home"}, isDirFi(true), nil), call("mkdirAll", stub.ExpectArgs{"/sysroot/home", os.FileMode(0700)}, nil, nil), call("verbosef", stub.ExpectArgs{"mounting %q flags %#x", []any{"/sysroot/home", uintptr(0x4004)}}, nil, nil), call("bindMount", stub.ExpectArgs{"/host/home", "/sysroot/home", uintptr(0x4004), false}, nil, nil),
+			call("stat", stub.ExpectArgs{"/host/lib64"}, isDirFi(true), nil), call("mkdirAll", stub.ExpectArgs{"/sysroot/lib64", os.FileMode(0700)}, nil, nil), call("verbosef", stub.ExpectArgs{"mounting %q flags %#x", []any{"/sysroot/lib64", uintptr(0x4004)}}, nil, nil), call("bindMount", stub.ExpectArgs{"/host/lib64", "/sysroot/lib64", uintptr(0x4004), false}, nil, nil),
+			call("stat", stub.ExpectArgs{"/host/lost+found"}, isDirFi(true), nil), call("mkdirAll", stub.ExpectArgs{"/sysroot/lost+found", os.FileMode(0700)}, nil, nil), call("verbosef", stub.ExpectArgs{"mounting %q flags %#x", []any{"/sysroot/lost+found", uintptr(0x4004)}}, nil, nil), call("bindMount", stub.ExpectArgs{"/host/lost+found", "/sysroot/lost+found", uintptr(0x4004), false}, nil, nil),
+			call("stat", stub.ExpectArgs{"/host/nix"}, isDirFi(true), nil), call("mkdirAll", stub.ExpectArgs{"/sysroot/nix", os.FileMode(0700)}, nil, nil), call("verbosef", stub.ExpectArgs{"mounting %q flags %#x", []any{"/sysroot/nix", uintptr(0x4004)}}, nil, nil), call("bindMount", stub.ExpectArgs{"/host/nix", "/sysroot/nix", uintptr(0x4004), false}, nil, nil),
+			call("stat", stub.ExpectArgs{"/host/root"}, isDirFi(true), nil), call("mkdirAll", stub.ExpectArgs{"/sysroot/root", os.FileMode(0700)}, nil, nil), call("verbosef", stub.ExpectArgs{"mounting %q flags %#x", []any{"/sysroot/root", uintptr(0x4004)}}, nil, nil), call("bindMount", stub.ExpectArgs{"/host/root", "/sysroot/root", uintptr(0x4004), false}, nil, nil),
+			call("stat", stub.ExpectArgs{"/host/run"}, isDirFi(true), nil), call("mkdirAll", stub.ExpectArgs{"/sysroot/run", os.FileMode(0700)}, nil, nil), call("verbosef", stub.ExpectArgs{"mounting %q flags %#x", []any{"/sysroot/run", uintptr(0x4004)}}, nil, nil), call("bindMount", stub.ExpectArgs{"/host/run", "/sysroot/run", uintptr(0x4004), false}, nil, nil),
+			call("stat", stub.ExpectArgs{"/host/srv"}, isDirFi(true), nil), call("mkdirAll", stub.ExpectArgs{"/sysroot/srv", os.FileMode(0700)}, nil, nil), call("verbosef", stub.ExpectArgs{"mounting %q flags %#x", []any{"/sysroot/srv", uintptr(0x4004)}}, nil, nil), call("bindMount", stub.ExpectArgs{"/host/srv", "/sysroot/srv", uintptr(0x4004), false}, nil, nil),
+			call("stat", stub.ExpectArgs{"/host/sys"}, isDirFi(true), nil), call("mkdirAll", stub.ExpectArgs{"/sysroot/sys", os.FileMode(0700)}, nil, nil), call("verbosef", stub.ExpectArgs{"mounting %q flags %#x", []any{"/sysroot/sys", uintptr(0x4004)}}, nil, nil), call("bindMount", stub.ExpectArgs{"/host/sys", "/sysroot/sys", uintptr(0x4004), false}, nil, nil),
+			call("stat", stub.ExpectArgs{"/host/usr"}, isDirFi(true), nil), call("mkdirAll", stub.ExpectArgs{"/sysroot/usr", os.FileMode(0700)}, nil, nil), call("verbosef", stub.ExpectArgs{"mounting %q flags %#x", []any{"/sysroot/usr", uintptr(0x4004)}}, nil, nil), call("bindMount", stub.ExpectArgs{"/host/usr", "/sysroot/usr", uintptr(0x4004), false}, nil, nil),
+			call("stat", stub.ExpectArgs{"/host/var"}, isDirFi(true), nil), call("mkdirAll", stub.ExpectArgs{"/sysroot/var", os.FileMode(0700)}, nil, nil), call("verbosef", stub.ExpectArgs{"mounting %q flags %#x", []any{"/sysroot/var", uintptr(0x4004)}}, nil, nil), call("bindMount", stub.ExpectArgs{"/host/var", "/sysroot/var", uintptr(0x4004), false}, nil, nil),
+		}, nil},
+
+		{"success", &Params{ParentPerm: 0750}, &AutoRootOp{
+			Host: MustAbs("/var/lib/planterette/base/debian:f92c9052"),
+		}, []stub.Call{
+			call("readdir", stub.ExpectArgs{"/var/lib/planterette/base/debian:f92c9052"}, stubDir("bin", "dev", "etc", "home", "lib64",
+				"lost+found", "mnt", "nix", "proc", "root", "run", "srv", "sys", "tmp", "usr", "var"), nil),
+			call("evalSymlinks", stub.ExpectArgs{"/var/lib/planterette/base/debian:f92c9052/bin"}, "/var/lib/planterette/base/debian:f92c9052/usr/bin", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/var/lib/planterette/base/debian:f92c9052/home"}, "/var/lib/planterette/base/debian:f92c9052/home", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/var/lib/planterette/base/debian:f92c9052/lib64"}, "/var/lib/planterette/base/debian:f92c9052/lib64", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/var/lib/planterette/base/debian:f92c9052/lost+found"}, "/var/lib/planterette/base/debian:f92c9052/lost+found", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/var/lib/planterette/base/debian:f92c9052/nix"}, "/var/lib/planterette/base/debian:f92c9052/nix", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/var/lib/planterette/base/debian:f92c9052/root"}, "/var/lib/planterette/base/debian:f92c9052/root", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/var/lib/planterette/base/debian:f92c9052/run"}, "/var/lib/planterette/base/debian:f92c9052/run", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/var/lib/planterette/base/debian:f92c9052/srv"}, "/var/lib/planterette/base/debian:f92c9052/srv", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/var/lib/planterette/base/debian:f92c9052/sys"}, "/var/lib/planterette/base/debian:f92c9052/sys", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/var/lib/planterette/base/debian:f92c9052/usr"}, "/var/lib/planterette/base/debian:f92c9052/usr", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/var/lib/planterette/base/debian:f92c9052/var"}, "/var/lib/planterette/base/debian:f92c9052/var", nil),
+		}, nil, []stub.Call{
+			call("stat", stub.ExpectArgs{"/host/var/lib/planterette/base/debian:f92c9052/usr/bin"}, isDirFi(true), nil), call("mkdirAll", stub.ExpectArgs{"/sysroot/bin", os.FileMode(0700)}, nil, nil), call("verbosef", stub.ExpectArgs{"mounting %q on %q flags %#x", []any{"/host/var/lib/planterette/base/debian:f92c9052/usr/bin", "/sysroot/bin", uintptr(0x4005)}}, nil, nil), call("bindMount", stub.ExpectArgs{"/host/var/lib/planterette/base/debian:f92c9052/usr/bin", "/sysroot/bin", uintptr(0x4005), false}, nil, nil),
+			call("stat", stub.ExpectArgs{"/host/var/lib/planterette/base/debian:f92c9052/home"}, isDirFi(true), nil), call("mkdirAll", stub.ExpectArgs{"/sysroot/home", os.FileMode(0700)}, nil, nil), call("verbosef", stub.ExpectArgs{"mounting %q on %q flags %#x", []any{"/host/var/lib/planterette/base/debian:f92c9052/home", "/sysroot/home", uintptr(0x4005)}}, nil, nil), call("bindMount", stub.ExpectArgs{"/host/var/lib/planterette/base/debian:f92c9052/home", "/sysroot/home", uintptr(0x4005), false}, nil, nil),
+			call("stat", stub.ExpectArgs{"/host/var/lib/planterette/base/debian:f92c9052/lib64"}, isDirFi(true), nil), call("mkdirAll", stub.ExpectArgs{"/sysroot/lib64", os.FileMode(0700)}, nil, nil), call("verbosef", stub.ExpectArgs{"mounting %q on %q flags %#x", []any{"/host/var/lib/planterette/base/debian:f92c9052/lib64", "/sysroot/lib64", uintptr(0x4005)}}, nil, nil), call("bindMount", stub.ExpectArgs{"/host/var/lib/planterette/base/debian:f92c9052/lib64", "/sysroot/lib64", uintptr(0x4005), false}, nil, nil),
+			call("stat", stub.ExpectArgs{"/host/var/lib/planterette/base/debian:f92c9052/lost+found"}, isDirFi(true), nil), call("mkdirAll", stub.ExpectArgs{"/sysroot/lost+found", os.FileMode(0700)}, nil, nil), call("verbosef", stub.ExpectArgs{"mounting %q on %q flags %#x", []any{"/host/var/lib/planterette/base/debian:f92c9052/lost+found", "/sysroot/lost+found", uintptr(0x4005)}}, nil, nil), call("bindMount", stub.ExpectArgs{"/host/var/lib/planterette/base/debian:f92c9052/lost+found", "/sysroot/lost+found", uintptr(0x4005), false}, nil, nil),
+			call("stat", stub.ExpectArgs{"/host/var/lib/planterette/base/debian:f92c9052/nix"}, isDirFi(true), nil), call("mkdirAll", stub.ExpectArgs{"/sysroot/nix", os.FileMode(0700)}, nil, nil), call("verbosef", stub.ExpectArgs{"mounting %q on %q flags %#x", []any{"/host/var/lib/planterette/base/debian:f92c9052/nix", "/sysroot/nix", uintptr(0x4005)}}, nil, nil), call("bindMount", stub.ExpectArgs{"/host/var/lib/planterette/base/debian:f92c9052/nix", "/sysroot/nix", uintptr(0x4005), false}, nil, nil),
+			call("stat", stub.ExpectArgs{"/host/var/lib/planterette/base/debian:f92c9052/root"}, isDirFi(true), nil), call("mkdirAll", stub.ExpectArgs{"/sysroot/root", os.FileMode(0700)}, nil, nil), call("verbosef", stub.ExpectArgs{"mounting %q on %q flags %#x", []any{"/host/var/lib/planterette/base/debian:f92c9052/root", "/sysroot/root", uintptr(0x4005)}}, nil, nil), call("bindMount", stub.ExpectArgs{"/host/var/lib/planterette/base/debian:f92c9052/root", "/sysroot/root", uintptr(0x4005), false}, nil, nil),
+			call("stat", stub.ExpectArgs{"/host/var/lib/planterette/base/debian:f92c9052/run"}, isDirFi(true), nil), call("mkdirAll", stub.ExpectArgs{"/sysroot/run", os.FileMode(0700)}, nil, nil), call("verbosef", stub.ExpectArgs{"mounting %q on %q flags %#x", []any{"/host/var/lib/planterette/base/debian:f92c9052/run", "/sysroot/run", uintptr(0x4005)}}, nil, nil), call("bindMount", stub.ExpectArgs{"/host/var/lib/planterette/base/debian:f92c9052/run", "/sysroot/run", uintptr(0x4005), false}, nil, nil),
+			call("stat", stub.ExpectArgs{"/host/var/lib/planterette/base/debian:f92c9052/srv"}, isDirFi(true), nil), call("mkdirAll", stub.ExpectArgs{"/sysroot/srv", os.FileMode(0700)}, nil, nil), call("verbosef", stub.ExpectArgs{"mounting %q on %q flags %#x", []any{"/host/var/lib/planterette/base/debian:f92c9052/srv", "/sysroot/srv", uintptr(0x4005)}}, nil, nil), call("bindMount", stub.ExpectArgs{"/host/var/lib/planterette/base/debian:f92c9052/srv", "/sysroot/srv", uintptr(0x4005), false}, nil, nil),
+			call("stat", stub.ExpectArgs{"/host/var/lib/planterette/base/debian:f92c9052/sys"}, isDirFi(true), nil), call("mkdirAll", stub.ExpectArgs{"/sysroot/sys", os.FileMode(0700)}, nil, nil), call("verbosef", stub.ExpectArgs{"mounting %q on %q flags %#x", []any{"/host/var/lib/planterette/base/debian:f92c9052/sys", "/sysroot/sys", uintptr(0x4005)}}, nil, nil), call("bindMount", stub.ExpectArgs{"/host/var/lib/planterette/base/debian:f92c9052/sys", "/sysroot/sys", uintptr(0x4005), false}, nil, nil),
+			call("stat", stub.ExpectArgs{"/host/var/lib/planterette/base/debian:f92c9052/usr"}, isDirFi(true), nil), call("mkdirAll", stub.ExpectArgs{"/sysroot/usr", os.FileMode(0700)}, nil, nil), call("verbosef", stub.ExpectArgs{"mounting %q on %q flags %#x", []any{"/host/var/lib/planterette/base/debian:f92c9052/usr", "/sysroot/usr", uintptr(0x4005)}}, nil, nil), call("bindMount", stub.ExpectArgs{"/host/var/lib/planterette/base/debian:f92c9052/usr", "/sysroot/usr", uintptr(0x4005), false}, nil, nil),
+			call("stat", stub.ExpectArgs{"/host/var/lib/planterette/base/debian:f92c9052/var"}, isDirFi(true), nil), call("mkdirAll", stub.ExpectArgs{"/sysroot/var", os.FileMode(0700)}, nil, nil), call("verbosef", stub.ExpectArgs{"mounting %q on %q flags %#x", []any{"/host/var/lib/planterette/base/debian:f92c9052/var", "/sysroot/var", uintptr(0x4005)}}, nil, nil), call("bindMount", stub.ExpectArgs{"/host/var/lib/planterette/base/debian:f92c9052/var", "/sysroot/var", uintptr(0x4005), false}, nil, nil),
+		}, nil},
+	})
+
+	checkOpsValid(t, []opValidTestCase{
+		{"nil", (*AutoRootOp)(nil), false},
+		{"zero", new(AutoRootOp), false},
+		{"valid", &AutoRootOp{Host: MustAbs("/")}, true},
+	})
+
+	checkOpsBuilder(t, []opsBuilderTestCase{
+		{"pd", new(Ops).Root(MustAbs("/"), BindWritable), Ops{
+			&AutoRootOp{
+				Host:  MustAbs("/"),
+				Flags: BindWritable,
+			},
+		}},
+	})
+
+	checkOpIs(t, []opIsTestCase{
+		{"zero", new(AutoRootOp), new(AutoRootOp), false},
+
+		{"internal ne", &AutoRootOp{
+			Host:  MustAbs("/"),
+			Flags: BindWritable,
+		}, &AutoRootOp{
+			Host:     MustAbs("/"),
+			Flags:    BindWritable,
+			resolved: []*BindMountOp{new(BindMountOp)},
+		}, true},
+
+		{"flags differs", &AutoRootOp{
+			Host:  MustAbs("/"),
+			Flags: BindWritable | BindDevice,
+		}, &AutoRootOp{
+			Host:  MustAbs("/"),
+			Flags: BindWritable,
+		}, false},
+
+		{"host differs", &AutoRootOp{
+			Host:  MustAbs("/tmp/"),
+			Flags: BindWritable,
+		}, &AutoRootOp{
+			Host:  MustAbs("/"),
+			Flags: BindWritable,
+		}, false},
+
+		{"equals", &AutoRootOp{
+			Host:  MustAbs("/"),
+			Flags: BindWritable,
+		}, &AutoRootOp{
+			Host:  MustAbs("/"),
+			Flags: BindWritable,
+		}, true},
+	})
+
+	checkOpMeta(t, []opMetaTestCase{
+		{"root", &AutoRootOp{
+			Host:  MustAbs("/"),
+			Flags: BindWritable,
+		}, "setting up", `auto root "/" flags 0x2`},
+	})
+}
+
+func TestIsAutoRootBindable(t *testing.T) {
+	testCases := []struct {
+		name string
+		want bool
+	}{
+		{"proc", false},
+		{"dev", false},
+		{"tmp", false},
+		{"mnt", false},
+		{"etc", false},
+		{"", false},
+
+		{"var", true},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := IsAutoRootBindable(tc.name); got != tc.want {
+				t.Errorf("IsAutoRootBindable: %v, want %v", got, tc.want)
+			}
+		})
+	}
+}

container/capability.go

@@ -12,8 +12,9 @@ const (
 	PR_CAP_AMBIENT_RAISE     = 0x2
 	PR_CAP_AMBIENT_CLEAR_ALL = 0x4
 
-	CAP_SYS_ADMIN = 0x15
-	CAP_SETPCAP   = 0x8
+	CAP_SYS_ADMIN    = 0x15
+	CAP_SETPCAP      = 0x8
+	CAP_DAC_OVERRIDE = 0x1
 )
 
 type (
@@ -36,9 +37,52 @@ func capToIndex(cap uintptr) uintptr { return cap >> 5 }
 func capToMask(cap uintptr) uint32 { return 1 << uint(cap&31) }
 
 func capset(hdrp *capHeader, datap *[2]capData) error {
-	if _, _, errno := syscall.Syscall(syscall.SYS_CAPSET,
+	r, _, errno := syscall.Syscall(
+		syscall.SYS_CAPSET,
 		uintptr(unsafe.Pointer(hdrp)),
-		uintptr(unsafe.Pointer(&datap[0])), 0); errno != 0 {
+		uintptr(unsafe.Pointer(&datap[0])), 0,
+	)
+	if r != 0 {
+		return errno
+	}
+	return nil
+}
+
+// capBoundingSetDrop drops a capability from the calling thread's capability bounding set.
+func capBoundingSetDrop(cap uintptr) error {
+	r, _, errno := syscall.Syscall(
+		syscall.SYS_PRCTL,
+		syscall.PR_CAPBSET_DROP,
+		cap, 0,
+	)
+	if r != 0 {
+		return errno
+	}
+	return nil
+}
+
+// capAmbientClearAll clears the ambient capability set of the calling thread.
+func capAmbientClearAll() error {
+	r, _, errno := syscall.Syscall(
+		syscall.SYS_PRCTL,
+		PR_CAP_AMBIENT,
+		PR_CAP_AMBIENT_CLEAR_ALL, 0,
+	)
+	if r != 0 {
+		return errno
+	}
+	return nil
+}
+
+// capAmbientRaise adds to the ambient capability set of the calling thread.
+func capAmbientRaise(cap uintptr) error {
+	r, _, errno := syscall.Syscall(
+		syscall.SYS_PRCTL,
+		PR_CAP_AMBIENT,
+		PR_CAP_AMBIENT_RAISE,
+		cap,
+	)
+	if r != 0 {
 		return errno
 	}
 	return nil

container/capability_test.go

@@ -0,0 +1,41 @@
+package container
+
+import "testing"
+
+func TestCapToIndex(t *testing.T) {
+	testCases := []struct {
+		name string
+		cap  uintptr
+		want uintptr
+	}{
+		{"CAP_SYS_ADMIN", CAP_SYS_ADMIN, 0},
+		{"CAP_SETPCAP", CAP_SETPCAP, 0},
+		{"CAP_DAC_OVERRIDE", CAP_DAC_OVERRIDE, 0},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := capToIndex(tc.cap); got != tc.want {
+				t.Errorf("capToIndex: %#x, want %#x", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestCapToMask(t *testing.T) {
+	testCases := []struct {
+		name string
+		cap  uintptr
+		want uint32
+	}{
+		{"CAP_SYS_ADMIN", CAP_SYS_ADMIN, 0x200000},
+		{"CAP_SETPCAP", CAP_SETPCAP, 0x100},
+		{"CAP_DAC_OVERRIDE", CAP_DAC_OVERRIDE, 0x2},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := capToMask(tc.cap); got != tc.want {
+				t.Errorf("capToMask: %#x, want %#x", got, tc.want)
+			}
+		})
+	}
+}

container/container.go

@@ -9,7 +9,7 @@ import (
 	"io"
 	"os"
 	"os/exec"
-	"path"
+	"runtime"
 	"strconv"
 	. "syscall"
 	"time"
@@ -17,25 +17,28 @@ import (
 	"hakurei.app/container/seccomp"
 )
 
+const (
+	// CancelSignal is the signal expected by container init on context cancel.
+	// A custom [Container.Cancel] function must eventually deliver this signal.
+	CancelSignal = SIGTERM
+)
+
 type (
 	// Container represents a container environment being prepared or run.
 	// None of [Container] methods are safe for concurrent use.
 	Container struct {
-		// Name of initial process in the container.
-		name string
 		// Cgroup fd, nil to disable.
 		Cgroup *int
 		// ExtraFiles passed through to initial process in the container,
 		// with behaviour identical to its [exec.Cmd] counterpart.
 		ExtraFiles []*os.File
 
-		// Custom [exec.Cmd] initialisation function.
-		CommandContext func(ctx context.Context) (cmd *exec.Cmd)
-
 		// param encoder for shim and init
 		setup *gob.Encoder
 		// cancels cmd
 		cancel context.CancelFunc
+		// closed after Wait returns
+		wait chan struct{}
 
 		Stdin  io.Reader
 		Stdout io.Writer
@@ -52,13 +55,17 @@ type (
 	// Params holds container configuration and is safe to serialise.
 	Params struct {
 		// Working directory in the container.
-		Dir string
+		Dir *Absolute
 		// Initial process environment.
 		Env []string
-		// Absolute path of initial process in the container. Overrides name.
-		Path string
+		// Pathname of initial process in the container.
+		Path *Absolute
 		// Initial process argv.
 		Args []string
+		// Deliver SIGINT to the initial process on context cancellation.
+		ForwardCancel bool
+		// Time to wait for processes lingering after the initial process terminates.
+		AdoptWaitDelay time.Duration
 
 		// Mapped Uid in user namespace.
 		Uid int
@@ -68,6 +75,7 @@ type (
 		Hostname string
 		// Sequential container setup ops.
 		*Ops
+
 		// Seccomp system call filter rules.
 		SeccompRules []seccomp.NativeRule
 		// Extra seccomp flags.
@@ -76,6 +84,7 @@ type (
 		SeccompPresets seccomp.FilterPreset
 		// Do not load seccomp program.
 		SeccompDisable bool
+
 		// Permission bits of newly created parent directories.
 		// The zero value is interpreted as 0755.
 		ParentPerm os.FileMode
@@ -83,25 +92,72 @@ type (
 		RetainSession bool
 		// Do not [syscall.CLONE_NEWNET].
 		HostNet bool
+		// Do not [LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET].
+		HostAbstract bool
 		// Retain CAP_SYS_ADMIN.
 		Privileged bool
 	}
 )
 
+// A StartError contains additional information on a container startup failure.
+type StartError struct {
+	// Fatal suggests whether this error should be considered fatal for the entire program.
+	Fatal bool
+	// Step refers to the part of the setup this error is returned from.
+	Step string
+	// Err is the underlying error.
+	Err error
+	// Origin is whether this error originated from the [Container.Start] method.
+	Origin bool
+	// Passthrough is whether the Error method is passed through to Err.
+	Passthrough bool
+}
+
+func (e *StartError) Unwrap() error { return e.Err }
+func (e *StartError) Error() string {
+	if e.Passthrough {
+		return e.Err.Error()
+	}
+	if e.Origin {
+		return e.Step
+	}
+
+	{
+		var syscallError *os.SyscallError
+		if errors.As(e.Err, &syscallError) && syscallError != nil {
+			return e.Step + " " + syscallError.Error()
+		}
+	}
+
+	return e.Step + ": " + e.Err.Error()
+}
+
+// Message returns a user-facing error message.
+func (e *StartError) Message() string {
+	if e.Passthrough {
+		switch {
+		case errors.As(e.Err, new(*os.PathError)),
+			errors.As(e.Err, new(*os.SyscallError)):
+			return "cannot " + e.Err.Error()
+
+		default:
+			return e.Err.Error()
+		}
+	}
+	if e.Origin {
+		return e.Step
+	}
+	return "cannot " + e.Error()
+}
+
+// Start starts the container init. The init process blocks until Serve is called.
 func (p *Container) Start() error {
-	if p.cmd != nil {
-		return errors.New("sandbox: already started")
+	if p == nil || p.cmd == nil ||
+		p.Ops == nil || len(*p.Ops) == 0 {
+		return errors.New("container: starting an invalid container")
 	}
-	if p.Ops == nil || len(*p.Ops) == 0 {
-		return errors.New("sandbox: starting an empty container")
-	}
-
-	ctx, cancel := context.WithCancel(p.ctx)
-	p.cancel = cancel
-
-	var cloneFlags uintptr = CLONE_NEWIPC | CLONE_NEWUTS | CLONE_NEWCGROUP
-	if !p.HostNet {
-		cloneFlags |= CLONE_NEWNET
+	if p.cmd.Process != nil {
+		return errors.New("container: already started")
 	}
 
 	// map to overflow id to work around ownership checks
@@ -116,52 +172,132 @@ func (p *Container) Start() error {
 		p.SeccompPresets |= seccomp.PresetDenyTTY
 	}
 
-	if p.CommandContext != nil {
-		p.cmd = p.CommandContext(ctx)
-	} else {
-		p.cmd = exec.CommandContext(ctx, MustExecutable())
-		p.cmd.Args = []string{"init"}
+	if p.AdoptWaitDelay == 0 {
+		p.AdoptWaitDelay = 5 * time.Second
+	}
+	// to allow disabling this behaviour
+	if p.AdoptWaitDelay < 0 {
+		p.AdoptWaitDelay = 0
 	}
 
-	p.cmd.Stdin, p.cmd.Stdout, p.cmd.Stderr = p.Stdin, p.Stdout, p.Stderr
+	if p.cmd.Stdin == nil {
+		p.cmd.Stdin = p.Stdin
+	}
+	if p.cmd.Stdout == nil {
+		p.cmd.Stdout = p.Stdout
+	}
+	if p.cmd.Stderr == nil {
+		p.cmd.Stderr = p.Stderr
+	}
+
+	p.cmd.Args = []string{initName}
 	p.cmd.WaitDelay = p.WaitDelay
 	if p.Cancel != nil {
 		p.cmd.Cancel = func() error { return p.Cancel(p.cmd) }
 	} else {
-		p.cmd.Cancel = func() error { return p.cmd.Process.Signal(SIGTERM) }
+		p.cmd.Cancel = func() error { return p.cmd.Process.Signal(CancelSignal) }
 	}
-	p.cmd.Dir = "/"
+	p.cmd.Dir = FHSRoot
 	p.cmd.SysProcAttr = &SysProcAttr{
-		Setsid:     !p.RetainSession,
-		Pdeathsig:  SIGKILL,
-		Cloneflags: cloneFlags | CLONE_NEWUSER | CLONE_NEWPID | CLONE_NEWNS,
+		Setsid:    !p.RetainSession,
+		Pdeathsig: SIGKILL,
+		Cloneflags: CLONE_NEWUSER | CLONE_NEWPID | CLONE_NEWNS |
+			CLONE_NEWIPC | CLONE_NEWUTS | CLONE_NEWCGROUP,
 
-		// remain privileged for setup
-		AmbientCaps: []uintptr{CAP_SYS_ADMIN, CAP_SETPCAP},
+		AmbientCaps: []uintptr{
+			// general container setup
+			CAP_SYS_ADMIN,
+			// drop capabilities
+			CAP_SETPCAP,
+			// overlay access to upperdir and workdir
+			CAP_DAC_OVERRIDE,
+		},
 
 		UseCgroupFD: p.Cgroup != nil,
 	}
 	if p.cmd.SysProcAttr.UseCgroupFD {
 		p.cmd.SysProcAttr.CgroupFD = *p.Cgroup
 	}
+	if !p.HostNet {
+		p.cmd.SysProcAttr.Cloneflags |= CLONE_NEWNET
+	}
 
 	// place setup pipe before user supplied extra files, this is later restored by init
 	if fd, e, err := Setup(&p.cmd.ExtraFiles); err != nil {
-		return wrapErrSuffix(err,
-			"cannot create shim setup pipe:")
+		return &StartError{true, "set up params stream", err, false, false}
 	} else {
 		p.setup = e
 		p.cmd.Env = []string{setupEnv + "=" + strconv.Itoa(fd)}
 	}
 	p.cmd.ExtraFiles = append(p.cmd.ExtraFiles, p.ExtraFiles...)
 
-	msg.Verbose("starting container init")
-	if err := p.cmd.Start(); err != nil {
-		return msg.WrapErr(err, err.Error())
-	}
-	return nil
+	done := make(chan error, 1)
+	go func() {
+		runtime.LockOSThread()
+		p.wait = make(chan struct{})
+
+		done <- func() error { // setup depending on per-thread state must happen here
+			// PR_SET_NO_NEW_PRIVS: depends on per-thread state but acts on all processes created from that thread
+			if err := SetNoNewPrivs(); err != nil {
+				return &StartError{true, "prctl(PR_SET_NO_NEW_PRIVS)", err, false, false}
+			}
+
+			// landlock: depends on per-thread state but acts on a process group
+			{
+				rulesetAttr := &RulesetAttr{Scoped: LANDLOCK_SCOPE_SIGNAL}
+				if !p.HostAbstract {
+					rulesetAttr.Scoped |= LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET
+				}
+
+				if abi, err := LandlockGetABI(); err != nil {
+					if p.HostAbstract {
+						// landlock can be skipped here as it restricts access to resources
+						// already covered by namespaces (pid)
+						goto landlockOut
+					}
+					return &StartError{false, "get landlock ABI", err, false, false}
+				} else if abi < 6 {
+					if p.HostAbstract {
+						// see above comment
+						goto landlockOut
+					}
+					return &StartError{false, "kernel version too old for LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET", ENOSYS, true, false}
+				} else {
+					msg.Verbosef("landlock abi version %d", abi)
+				}
+
+				if rulesetFd, err := rulesetAttr.Create(0); err != nil {
+					return &StartError{true, "create landlock ruleset", err, false, false}
+				} else {
+					msg.Verbosef("enforcing landlock ruleset %s", rulesetAttr)
+					if err = LandlockRestrictSelf(rulesetFd, 0); err != nil {
+						_ = Close(rulesetFd)
+						return &StartError{true, "enforce landlock ruleset", err, false, false}
+					}
+					if err = Close(rulesetFd); err != nil {
+						msg.Verbosef("cannot close landlock ruleset: %v", err)
+						// not fatal
+					}
+				}
+
+			landlockOut:
+			}
+
+			msg.Verbose("starting container init")
+			if err := p.cmd.Start(); err != nil {
+				return &StartError{false, "start container init", err, false, true}
+			}
+			return nil
+		}()
+
+		// keep this thread alive until Wait returns for cancel
+		<-p.wait
+	}()
+	return <-done
 }
 
+// Serve serves [Container.Params] to the container init.
+// Serve must only be called once.
 func (p *Container) Serve() error {
 	if p.setup == nil {
 		panic("invalid serve")
@@ -170,33 +306,16 @@ func (p *Container) Serve() error {
 	setup := p.setup
 	p.setup = nil
 
-	if p.Path != "" && !path.IsAbs(p.Path) {
+	if p.Path == nil {
 		p.cancel()
-		return msg.WrapErr(EINVAL,
-			fmt.Sprintf("invalid executable path %q", p.Path))
+		return &StartError{false, "invalid executable pathname", EINVAL, true, false}
 	}
 
-	if p.Path == "" {
-		if p.name == "" {
-			p.Path = os.Getenv("SHELL")
-			if !path.IsAbs(p.Path) {
-				p.cancel()
-				return msg.WrapErr(EBADE,
-					"no command specified and $SHELL is invalid")
-			}
-			p.name = path.Base(p.Path)
-		} else if path.IsAbs(p.name) {
-			p.Path = p.name
-		} else if v, err := exec.LookPath(p.name); err != nil {
-			p.cancel()
-			return msg.WrapErr(err, err.Error())
-		} else {
-			p.Path = v
-		}
+	// do not transmit nil
+	if p.Dir == nil {
+		p.Dir = AbsFHSRoot
 	}
-
 	if p.SeccompRules == nil {
-		// do not transmit nil
 		p.SeccompRules = make([]seccomp.NativeRule, 0)
 	}
 
@@ -215,15 +334,76 @@ func (p *Container) Serve() error {
 	return err
 }
 
-func (p *Container) Wait() error { defer p.cancel(); return p.cmd.Wait() }
+// Wait waits for the container init process to exit and releases any resources associated with the [Container].
+func (p *Container) Wait() error {
+	if p.cmd == nil || p.cmd.Process == nil {
+		return EINVAL
+	}
+
+	err := p.cmd.Wait()
+	p.cancel()
+	if p.wait != nil && err == nil {
+		close(p.wait)
+	}
+	return err
+}
+
+// StdinPipe calls the [exec.Cmd] method with the same name.
+func (p *Container) StdinPipe() (w io.WriteCloser, err error) {
+	if p.Stdin != nil {
+		return nil, errors.New("container: Stdin already set")
+	}
+	w, err = p.cmd.StdinPipe()
+	p.Stdin = p.cmd.Stdin
+	return
+}
+
+// StdoutPipe calls the [exec.Cmd] method with the same name.
+func (p *Container) StdoutPipe() (r io.ReadCloser, err error) {
+	if p.Stdout != nil {
+		return nil, errors.New("container: Stdout already set")
+	}
+	r, err = p.cmd.StdoutPipe()
+	p.Stdout = p.cmd.Stdout
+	return
+}
+
+// StderrPipe calls the [exec.Cmd] method with the same name.
+func (p *Container) StderrPipe() (r io.ReadCloser, err error) {
+	if p.Stderr != nil {
+		return nil, errors.New("container: Stderr already set")
+	}
+	r, err = p.cmd.StderrPipe()
+	p.Stderr = p.cmd.Stderr
+	return
+}
 
 func (p *Container) String() string {
 	return fmt.Sprintf("argv: %q, filter: %v, rules: %d, flags: %#x, presets: %#x",
 		p.Args, !p.SeccompDisable, len(p.SeccompRules), int(p.SeccompFlags), int(p.SeccompPresets))
 }
 
-func New(ctx context.Context, name string, args ...string) *Container {
-	return &Container{name: name, ctx: ctx,
-		Params: Params{Args: append([]string{name}, args...), Dir: "/", Ops: new(Ops)},
+// ProcessState returns the address to os.ProcessState held by the underlying [exec.Cmd].
+func (p *Container) ProcessState() *os.ProcessState {
+	if p.cmd == nil {
+		return nil
 	}
+	return p.cmd.ProcessState
+}
+
+// New returns the address to a new instance of [Container] that requires further initialisation before use.
+func New(ctx context.Context) *Container {
+	p := &Container{ctx: ctx, Params: Params{Ops: new(Ops)}}
+	c, cancel := context.WithCancel(ctx)
+	p.cancel = cancel
+	p.cmd = exec.CommandContext(c, MustExecutable())
+	return p
+}
+
+// NewCommand calls [New] and initialises the [Params.Path] and [Params.Args] fields.
+func NewCommand(ctx context.Context, pathname *Absolute, name string, args ...string) *Container {
+	z := New(ctx)
+	z.Path = pathname
+	z.Args = append([]string{name}, args...)
+	return z
 }

container/container_test.go

@@ -4,14 +4,21 @@ import (
 	"bytes"
 	"context"
 	"encoding/gob"
+	"errors"
+	"fmt"
 	"log"
+	"net"
 	"os"
 	"os/exec"
+	"os/signal"
+	"reflect"
+	"strconv"
 	"strings"
 	"syscall"
 	"testing"
 	"time"
 
+	"hakurei.app/command"
 	"hakurei.app/container"
 	"hakurei.app/container/seccomp"
 	"hakurei.app/container/vfs"
@@ -21,155 +28,460 @@ import (
 	"hakurei.app/ldd"
 )
 
+func TestStartError(t *testing.T) {
+	testCases := []struct {
+		name string
+		err  error
+		s    string
+		is   error
+		isF  error
+		msg  string
+	}{
+		{"params env", &container.StartError{
+			Fatal: true,
+			Step:  "set up params stream",
+			Err:   container.ErrReceiveEnv,
+		},
+			"set up params stream: environment variable not set",
+			container.ErrReceiveEnv, syscall.EBADF,
+			"cannot set up params stream: environment variable not set"},
+
+		{"params", &container.StartError{
+			Fatal: true,
+			Step:  "set up params stream",
+			Err:   &os.SyscallError{Syscall: "pipe2", Err: syscall.EBADF},
+		},
+			"set up params stream pipe2: bad file descriptor",
+			syscall.EBADF, os.ErrInvalid,
+			"cannot set up params stream pipe2: bad file descriptor"},
+
+		{"PR_SET_NO_NEW_PRIVS", &container.StartError{
+			Fatal: true,
+			Step:  "prctl(PR_SET_NO_NEW_PRIVS)",
+			Err:   syscall.EPERM,
+		},
+			"prctl(PR_SET_NO_NEW_PRIVS): operation not permitted",
+			syscall.EPERM, syscall.EACCES,
+			"cannot prctl(PR_SET_NO_NEW_PRIVS): operation not permitted"},
+
+		{"landlock abi", &container.StartError{
+			Step: "get landlock ABI",
+			Err:  syscall.ENOSYS,
+		},
+			"get landlock ABI: function not implemented",
+			syscall.ENOSYS, syscall.ENOEXEC,
+			"cannot get landlock ABI: function not implemented"},
+
+		{"landlock old", &container.StartError{
+			Step:   "kernel version too old for LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET",
+			Err:    syscall.ENOSYS,
+			Origin: true,
+		},
+			"kernel version too old for LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET",
+			syscall.ENOSYS, syscall.ENOSPC,
+			"kernel version too old for LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET"},
+
+		{"landlock create", &container.StartError{
+			Fatal: true,
+			Step:  "create landlock ruleset",
+			Err:   syscall.EBADFD,
+		},
+			"create landlock ruleset: file descriptor in bad state",
+			syscall.EBADFD, syscall.EBADF,
+			"cannot create landlock ruleset: file descriptor in bad state"},
+
+		{"landlock enforce", &container.StartError{
+			Fatal: true,
+			Step:  "enforce landlock ruleset",
+			Err:   syscall.ENOTRECOVERABLE,
+		},
+			"enforce landlock ruleset: state not recoverable",
+			syscall.ENOTRECOVERABLE, syscall.ETIMEDOUT,
+			"cannot enforce landlock ruleset: state not recoverable"},
+
+		{"start", &container.StartError{
+			Step: "start container init",
+			Err: &os.PathError{
+				Op:   "fork/exec",
+				Path: "/proc/nonexistent",
+				Err:  syscall.ENOENT,
+			}, Passthrough: true,
+		},
+			"fork/exec /proc/nonexistent: no such file or directory",
+			syscall.ENOENT, syscall.ENOSYS,
+			"cannot fork/exec /proc/nonexistent: no such file or directory"},
+
+		{"start syscall", &container.StartError{
+			Step: "start container init",
+			Err: &os.SyscallError{
+				Syscall: "open",
+				Err:     syscall.ENOSYS,
+			}, Passthrough: true,
+		},
+			"open: function not implemented",
+			syscall.ENOSYS, syscall.ENOENT,
+			"cannot open: function not implemented"},
+
+		{"start other", &container.StartError{
+			Step: "start container init",
+			Err: &net.OpError{
+				Op:  "dial",
+				Net: "unix",
+				Err: syscall.ECONNREFUSED,
+			}, Passthrough: true,
+		},
+			"dial unix: connection refused",
+			syscall.ECONNREFUSED, syscall.ECONNABORTED,
+			"dial unix: connection refused"},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Run("error", func(t *testing.T) {
+				if got := tc.err.Error(); got != tc.s {
+					t.Errorf("Error: %q, want %q", got, tc.s)
+				}
+			})
+
+			t.Run("is", func(t *testing.T) {
+				if !errors.Is(tc.err, tc.is) {
+					t.Error("Is: unexpected false")
+				}
+				if errors.Is(tc.err, tc.isF) {
+					t.Errorf("Is: unexpected true")
+				}
+			})
+
+			t.Run("msg", func(t *testing.T) {
+				if got, ok := container.GetErrorMessage(tc.err); !ok {
+					if tc.msg != "" {
+						t.Errorf("GetErrorMessage: err does not implement MessageError")
+					}
+					return
+				} else if got != tc.msg {
+					t.Errorf("GetErrorMessage: %q, want %q", got, tc.msg)
+				}
+			})
+		})
+	}
+}
+
 const (
 	ignore  = "\x00"
 	ignoreV = -1
+
+	pathPrefix   = "/etc/hakurei/"
+	pathWantMnt  = pathPrefix + "want-mnt"
+	pathReadonly = pathPrefix + "readonly"
 )
 
+type testVal any
+
+func emptyOps(t *testing.T) (*container.Ops, context.Context) { return new(container.Ops), t.Context() }
+func earlyOps(ops *container.Ops) func(t *testing.T) (*container.Ops, context.Context) {
+	return func(t *testing.T) (*container.Ops, context.Context) { return ops, t.Context() }
+}
+
+func emptyMnt(*testing.T, context.Context) []*vfs.MountInfoEntry { return nil }
+func earlyMnt(mnt ...*vfs.MountInfoEntry) func(*testing.T, context.Context) []*vfs.MountInfoEntry {
+	return func(*testing.T, context.Context) []*vfs.MountInfoEntry { return mnt }
+}
+
+var containerTestCases = []struct {
+	name    string
+	filter  bool
+	session bool
+	net     bool
+	ro      bool
+
+	ops func(t *testing.T) (*container.Ops, context.Context)
+	mnt func(t *testing.T, ctx context.Context) []*vfs.MountInfoEntry
+
+	uid int
+	gid int
+
+	rules   []seccomp.NativeRule
+	flags   seccomp.ExportFlag
+	presets seccomp.FilterPreset
+}{
+	{"minimal", true, false, false, true,
+		emptyOps, emptyMnt,
+		1000, 100, nil, 0, seccomp.PresetStrict},
+	{"allow", true, true, true, false,
+		emptyOps, emptyMnt,
+		1000, 100, nil, 0, seccomp.PresetExt | seccomp.PresetDenyDevel},
+	{"no filter", false, true, true, true,
+		emptyOps, emptyMnt,
+		1000, 100, nil, 0, seccomp.PresetExt},
+	{"custom rules", true, true, true, false,
+		emptyOps, emptyMnt,
+		1, 31, []seccomp.NativeRule{{Syscall: seccomp.ScmpSyscall(syscall.SYS_SETUID), Errno: seccomp.ScmpErrno(syscall.EPERM)}}, 0, seccomp.PresetExt},
+
+	{"tmpfs", true, false, false, true,
+		earlyOps(new(container.Ops).
+			Tmpfs(hst.AbsTmp, 0, 0755),
+		),
+		earlyMnt(
+			ent("/", hst.Tmp, "rw,nosuid,nodev,relatime", "tmpfs", "ephemeral", ignore),
+		),
+		9, 9, nil, 0, seccomp.PresetStrict},
+
+	{"dev", true, true /* go test output is not a tty */, false, false,
+		earlyOps(new(container.Ops).
+			Dev(container.MustAbs("/dev"), true),
+		),
+		earlyMnt(
+			ent("/", "/dev", "ro,nosuid,nodev,relatime", "tmpfs", "devtmpfs", ignore),
+			ent("/null", "/dev/null", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
+			ent("/zero", "/dev/zero", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
+			ent("/full", "/dev/full", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
+			ent("/random", "/dev/random", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
+			ent("/urandom", "/dev/urandom", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
+			ent("/tty", "/dev/tty", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
+			ent("/", "/dev/pts", "rw,nosuid,noexec,relatime", "devpts", "devpts", "rw,mode=620,ptmxmode=666"),
+			ent("/", "/dev/mqueue", "rw,nosuid,nodev,noexec,relatime", "mqueue", "mqueue", "rw"),
+			ent("/", "/dev/shm", "rw,nosuid,nodev,relatime", "tmpfs", "tmpfs", ignore),
+		),
+		1971, 100, nil, 0, seccomp.PresetStrict},
+
+	{"dev no mqueue", true, true /* go test output is not a tty */, false, false,
+		earlyOps(new(container.Ops).
+			Dev(container.MustAbs("/dev"), false),
+		),
+		earlyMnt(
+			ent("/", "/dev", "ro,nosuid,nodev,relatime", "tmpfs", "devtmpfs", ignore),
+			ent("/null", "/dev/null", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
+			ent("/zero", "/dev/zero", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
+			ent("/full", "/dev/full", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
+			ent("/random", "/dev/random", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
+			ent("/urandom", "/dev/urandom", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
+			ent("/tty", "/dev/tty", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
+			ent("/", "/dev/pts", "rw,nosuid,noexec,relatime", "devpts", "devpts", "rw,mode=620,ptmxmode=666"),
+			ent("/", "/dev/shm", "rw,nosuid,nodev,relatime", "tmpfs", "tmpfs", ignore),
+		),
+		1971, 100, nil, 0, seccomp.PresetStrict},
+
+	{"overlay", true, false, false, true,
+		func(t *testing.T) (*container.Ops, context.Context) {
+			tempDir := container.MustAbs(t.TempDir())
+			lower0, lower1, upper, work :=
+				tempDir.Append("lower0"),
+				tempDir.Append("lower1"),
+				tempDir.Append("upper"),
+				tempDir.Append("work")
+			for _, a := range []*container.Absolute{lower0, lower1, upper, work} {
+				if err := os.Mkdir(a.String(), 0755); err != nil {
+					t.Fatalf("Mkdir: error = %v", err)
+				}
+			}
+
+			return new(container.Ops).
+					Overlay(hst.AbsTmp, upper, work, lower0, lower1),
+				context.WithValue(context.WithValue(context.WithValue(context.WithValue(t.Context(),
+					testVal("lower1"), lower1),
+					testVal("lower0"), lower0),
+					testVal("work"), work),
+					testVal("upper"), upper)
+		},
+		func(t *testing.T, ctx context.Context) []*vfs.MountInfoEntry {
+			return []*vfs.MountInfoEntry{
+				ent("/", hst.Tmp, "rw", "overlay", "overlay",
+					"rw,lowerdir="+
+						container.InternalToHostOvlEscape(ctx.Value(testVal("lower0")).(*container.Absolute).String())+":"+
+						container.InternalToHostOvlEscape(ctx.Value(testVal("lower1")).(*container.Absolute).String())+
+						",upperdir="+
+						container.InternalToHostOvlEscape(ctx.Value(testVal("upper")).(*container.Absolute).String())+
+						",workdir="+
+						container.InternalToHostOvlEscape(ctx.Value(testVal("work")).(*container.Absolute).String())+
+						",redirect_dir=nofollow,uuid=on,userxattr"),
+			}
+		},
+		1 << 3, 1 << 14, nil, 0, seccomp.PresetStrict},
+
+	{"overlay ephemeral", true, false, false, true,
+		func(t *testing.T) (*container.Ops, context.Context) {
+			tempDir := container.MustAbs(t.TempDir())
+			lower0, lower1 :=
+				tempDir.Append("lower0"),
+				tempDir.Append("lower1")
+			for _, a := range []*container.Absolute{lower0, lower1} {
+				if err := os.Mkdir(a.String(), 0755); err != nil {
+					t.Fatalf("Mkdir: error = %v", err)
+				}
+			}
+
+			return new(container.Ops).
+					OverlayEphemeral(hst.AbsTmp, lower0, lower1),
+				t.Context()
+		},
+		func(t *testing.T, ctx context.Context) []*vfs.MountInfoEntry {
+			return []*vfs.MountInfoEntry{
+				// contains random suffix
+				ent("/", hst.Tmp, "rw", "overlay", "overlay", ignore),
+			}
+		},
+		1 << 3, 1 << 14, nil, 0, seccomp.PresetStrict},
+
+	{"overlay readonly", true, false, false, true,
+		func(t *testing.T) (*container.Ops, context.Context) {
+			tempDir := container.MustAbs(t.TempDir())
+			lower0, lower1 :=
+				tempDir.Append("lower0"),
+				tempDir.Append("lower1")
+			for _, a := range []*container.Absolute{lower0, lower1} {
+				if err := os.Mkdir(a.String(), 0755); err != nil {
+					t.Fatalf("Mkdir: error = %v", err)
+				}
+			}
+			return new(container.Ops).
+					OverlayReadonly(hst.AbsTmp, lower0, lower1),
+				context.WithValue(context.WithValue(t.Context(),
+					testVal("lower1"), lower1),
+					testVal("lower0"), lower0)
+		},
+		func(t *testing.T, ctx context.Context) []*vfs.MountInfoEntry {
+			return []*vfs.MountInfoEntry{
+				ent("/", hst.Tmp, "rw", "overlay", "overlay",
+					"ro,lowerdir="+
+						container.InternalToHostOvlEscape(ctx.Value(testVal("lower0")).(*container.Absolute).String())+":"+
+						container.InternalToHostOvlEscape(ctx.Value(testVal("lower1")).(*container.Absolute).String())+
+						",redirect_dir=nofollow,userxattr"),
+			}
+		},
+		1 << 3, 1 << 14, nil, 0, seccomp.PresetStrict},
+}
+
 func TestContainer(t *testing.T) {
-	{
-		oldVerbose := hlog.Load()
-		oldOutput := container.GetOutput()
-		internal.InstallOutput(true)
-		t.Cleanup(func() { hlog.Store(oldVerbose) })
-		t.Cleanup(func() { container.SetOutput(oldOutput) })
-	}
+	replaceOutput(t)
 
-	testCases := []struct {
-		name    string
-		filter  bool
-		session bool
-		net     bool
-		ops     *container.Ops
-		mnt     []*vfs.MountInfoEntry
-		host    string
-		rules   []seccomp.NativeRule
-		flags   seccomp.ExportFlag
-		presets seccomp.FilterPreset
-	}{
-		{"minimal", true, false, false,
-			new(container.Ops), nil, "test-minimal",
-			nil, 0, seccomp.PresetStrict},
-		{"allow", true, true, true,
-			new(container.Ops), nil, "test-minimal",
-			nil, 0, seccomp.PresetExt | seccomp.PresetDenyDevel},
-		{"no filter", false, true, true,
-			new(container.Ops), nil, "test-no-filter",
-			nil, 0, seccomp.PresetExt},
-		{"custom rules", true, true, true,
-			new(container.Ops), nil, "test-no-filter",
-			[]seccomp.NativeRule{
-				{seccomp.ScmpSyscall(syscall.SYS_SETUID), seccomp.ScmpErrno(syscall.EPERM), nil},
-			}, 0, seccomp.PresetExt},
-		{"tmpfs", true, false, false,
-			new(container.Ops).
-				Tmpfs(hst.Tmp, 0, 0755),
-			[]*vfs.MountInfoEntry{
-				e("/", hst.Tmp, "rw,nosuid,nodev,relatime", "tmpfs", "tmpfs", ignore),
-			}, "test-tmpfs",
-			nil, 0, seccomp.PresetStrict},
-		{"dev", true, true /* go test output is not a tty */, false,
-			new(container.Ops).
-				Dev("/dev").
-				Mqueue("/dev/mqueue"),
-			[]*vfs.MountInfoEntry{
-				e("/", "/dev", "rw,nosuid,nodev,relatime", "tmpfs", "devtmpfs", ignore),
-				e("/null", "/dev/null", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
-				e("/zero", "/dev/zero", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
-				e("/full", "/dev/full", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
-				e("/random", "/dev/random", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
-				e("/urandom", "/dev/urandom", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
-				e("/tty", "/dev/tty", "rw,nosuid", "devtmpfs", "devtmpfs", ignore),
-				e("/", "/dev/pts", "rw,nosuid,noexec,relatime", "devpts", "devpts", "rw,mode=620,ptmxmode=666"),
-				e("/", "/dev/mqueue", "rw,nosuid,nodev,noexec,relatime", "mqueue", "mqueue", "rw"),
-			}, "",
-			nil, 0, seccomp.PresetStrict},
-	}
+	t.Run("cancel", testContainerCancel(nil, func(t *testing.T, c *container.Container) {
+		wantErr := context.Canceled
+		wantExitCode := 0
+		if err := c.Wait(); !reflect.DeepEqual(err, wantErr) {
+			if m, ok := container.InternalMessageFromError(err); ok {
+				t.Error(m)
+			}
+			t.Errorf("Wait: error = %#v, want %#v", err, wantErr)
+		}
+		if ps := c.ProcessState(); ps == nil {
+			t.Errorf("ProcessState unexpectedly returned nil")
+		} else if code := ps.ExitCode(); code != wantExitCode {
+			t.Errorf("ExitCode: %d, want %d", code, wantExitCode)
+		}
+	}))
 
-	for _, tc := range testCases {
+	t.Run("forward", testContainerCancel(func(c *container.Container) {
+		c.ForwardCancel = true
+	}, func(t *testing.T, c *container.Container) {
+		var exitError *exec.ExitError
+		if err := c.Wait(); !errors.As(err, &exitError) {
+			if m, ok := container.InternalMessageFromError(err); ok {
+				t.Error(m)
+			}
+			t.Errorf("Wait: error = %v", err)
+		}
+		if code := exitError.ExitCode(); code != blockExitCodeInterrupt {
+			t.Errorf("ExitCode: %d, want %d", code, blockExitCodeInterrupt)
+		}
+	}))
+
+	for i, tc := range containerTestCases {
 		t.Run(tc.name, func(t *testing.T) {
-			ctx, cancel := context.WithTimeout(t.Context(), 5*time.Second)
+			wantOps, wantOpsCtx := tc.ops(t)
+			wantMnt := tc.mnt(t, wantOpsCtx)
+
+			ctx, cancel := context.WithTimeout(t.Context(), helperDefaultTimeout)
 			defer cancel()
 
-			c := container.New(ctx, "/usr/bin/sandbox.test", "-test.v",
-				"-test.run=TestHelperCheckContainer", "--", "check", tc.host)
-			c.Uid = 1000
-			c.Gid = 100
-			c.Hostname = tc.host
-			c.CommandContext = commandContext
-			c.Stdout, c.Stderr = os.Stdout, os.Stderr
-			c.Ops = tc.ops
+			var libPaths []*container.Absolute
+			c := helperNewContainerLibPaths(ctx, &libPaths, "container", strconv.Itoa(i))
+			c.Uid = tc.uid
+			c.Gid = tc.gid
+			c.Hostname = hostnameFromTestCase(tc.name)
+			output := new(bytes.Buffer)
+			if !testing.Verbose() {
+				c.Stdout, c.Stderr = output, output
+			} else {
+				c.Stdout, c.Stderr = os.Stdout, os.Stderr
+			}
+			c.WaitDelay = helperDefaultTimeout
+			*c.Ops = append(*c.Ops, *wantOps...)
 			c.SeccompRules = tc.rules
 			c.SeccompFlags = tc.flags | seccomp.AllowMultiarch
 			c.SeccompPresets = tc.presets
 			c.SeccompDisable = !tc.filter
 			c.RetainSession = tc.session
 			c.HostNet = tc.net
-			if c.Args[5] == "" {
-				if name, err := os.Hostname(); err != nil {
-					t.Fatalf("cannot get hostname: %v", err)
-				} else {
-					c.Args[5] = name
-				}
-			}
 
 			c.
-				Tmpfs("/tmp", 0, 0755).
-				Bind(os.Args[0], os.Args[0], 0).
-				Mkdir("/usr/bin", 0755).
-				Link(os.Args[0], "/usr/bin/sandbox.test").
-				Place("/etc/hostname", []byte(c.Args[5]))
-			// in case test has cgo enabled
-			var libPaths []string
-			if entries, err := ldd.ExecFilter(ctx,
-				commandContext,
-				func(v []byte) []byte {
-					return bytes.SplitN(v, []byte("TestHelperInit\n"), 2)[1]
-				}, os.Args[0]); err != nil {
-				log.Fatalf("ldd: %v", err)
-			} else {
-				libPaths = ldd.Path(entries)
-			}
-			for _, name := range libPaths {
-				c.Bind(name, name, 0)
-			}
+				Readonly(container.MustAbs(pathReadonly), 0755).
+				Tmpfs(container.MustAbs("/tmp"), 0, 0755).
+				Place(container.MustAbs("/etc/hostname"), []byte(c.Hostname))
 			// needs /proc to check mountinfo
-			c.Proc("/proc")
+			c.Proc(container.MustAbs("/proc"))
 
+			// mountinfo cannot be resolved directly by helper due to libPaths nondeterminism
 			mnt := make([]*vfs.MountInfoEntry, 0, 3+len(libPaths))
-			mnt = append(mnt, e("/sysroot", "/", "rw,nosuid,nodev,relatime", "tmpfs", "rootfs", ignore))
-			mnt = append(mnt, tc.mnt...)
 			mnt = append(mnt,
-				e("/", "/tmp", "rw,nosuid,nodev,relatime", "tmpfs", "tmpfs", ignore),
-				e(ignore, os.Args[0], "ro,nosuid,nodev,relatime", ignore, ignore, ignore),
-				e(ignore, "/etc/hostname", "ro,nosuid,nodev,relatime", "tmpfs", "rootfs", ignore),
+				ent("/sysroot", "/", "rw,nosuid,nodev,relatime", "tmpfs", "rootfs", ignore),
+				// Bind(os.Args[0], helperInnerPath, 0)
+				ent(ignore, helperInnerPath, "ro,nosuid,nodev,relatime", ignore, ignore, ignore),
 			)
-			for _, name := range libPaths {
-				mnt = append(mnt, e(ignore, name, "ro,nosuid,nodev,relatime", ignore, ignore, ignore))
+			for _, a := range libPaths {
+				// Bind(name, name, 0)
+				mnt = append(mnt, ent(ignore, a.String(), "ro,nosuid,nodev,relatime", ignore, ignore, ignore))
 			}
-			mnt = append(mnt, e("/", "/proc", "rw,nosuid,nodev,noexec,relatime", "proc", "proc", "rw"))
+			mnt = append(mnt, wantMnt...)
+			mnt = append(mnt,
+				// Readonly(pathReadonly, 0755)
+				ent("/", pathReadonly, "ro,nosuid,nodev", "tmpfs", "readonly", ignore),
+				// Tmpfs("/tmp", 0, 0755)
+				ent("/", "/tmp", "rw,nosuid,nodev,relatime", "tmpfs", "ephemeral", ignore),
+				// Place("/etc/hostname", []byte(hostname))
+				ent(ignore, "/etc/hostname", "ro,nosuid,nodev,relatime", "tmpfs", "rootfs", ignore),
+				// Proc("/proc")
+				ent("/", "/proc", "rw,nosuid,nodev,noexec,relatime", "proc", "proc", "rw"),
+				// Place(pathWantMnt, want.Bytes())
+				ent(ignore, pathWantMnt, "ro,nosuid,nodev,relatime", "tmpfs", "rootfs", ignore),
+			)
 			want := new(bytes.Buffer)
 			if err := gob.NewEncoder(want).Encode(mnt); err != nil {
+				_, _ = output.WriteTo(os.Stdout)
 				t.Fatalf("cannot serialise expected mount points: %v", err)
 			}
-			c.Stdin = want
+			c.Place(container.MustAbs(pathWantMnt), want.Bytes())
+
+			if tc.ro {
+				c.Remount(container.MustAbs("/"), syscall.MS_RDONLY)
+			}
 
 			if err := c.Start(); err != nil {
-				hlog.PrintBaseError(err, "start:")
-				t.Fatalf("cannot start container: %v", err)
+				_, _ = output.WriteTo(os.Stdout)
+				if m, ok := container.InternalMessageFromError(err); ok {
+					t.Fatal(m)
+				} else {
+					t.Fatalf("cannot start container: %v", err)
+				}
 			} else if err = c.Serve(); err != nil {
-				hlog.PrintBaseError(err, "serve:")
-				t.Errorf("cannot serve setup params: %v", err)
+				_, _ = output.WriteTo(os.Stdout)
+				if m, ok := container.InternalMessageFromError(err); ok {
+					t.Error(m)
+				} else {
+					t.Errorf("cannot serve setup params: %v", err)
+				}
 			}
 			if err := c.Wait(); err != nil {
-				hlog.PrintBaseError(err, "wait:")
-				t.Fatalf("wait: %v", err)
+				_, _ = output.WriteTo(os.Stdout)
+				if m, ok := container.InternalMessageFromError(err); ok {
+					t.Fatal(m)
+				} else {
+					t.Fatalf("wait: %v", err)
+				}
 			}
 		})
 	}
 }
 
-func e(root, target, vfsOptstr, fsType, source, fsOptstr string) *vfs.MountInfoEntry {
+func ent(root, target, vfsOptstr, fsType, source, fsOptstr string) *vfs.MountInfoEntry {
 	return &vfs.MountInfoEntry{
 		ID:        ignoreV,
 		Parent:    ignoreV,
@@ -184,8 +496,58 @@ func e(root, target, vfsOptstr, fsType, source, fsOptstr string) *vfs.MountInfoE
 	}
 }
 
+func hostnameFromTestCase(name string) string {
+	return "test-" + strings.Join(strings.Fields(name), "-")
+}
+
+func testContainerCancel(
+	containerExtra func(c *container.Container),
+	waitCheck func(t *testing.T, c *container.Container),
+) func(t *testing.T) {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(t.Context(), helperDefaultTimeout)
+
+		c := helperNewContainer(ctx, "block")
+		c.Stdout, c.Stderr = os.Stdout, os.Stderr
+		c.WaitDelay = helperDefaultTimeout
+		if containerExtra != nil {
+			containerExtra(c)
+		}
+
+		ready := make(chan struct{})
+		if r, w, err := os.Pipe(); err != nil {
+			t.Fatalf("cannot pipe: %v", err)
+		} else {
+			c.ExtraFiles = append(c.ExtraFiles, w)
+			go func() {
+				defer close(ready)
+				if _, err = r.Read(make([]byte, 1)); err != nil {
+					panic(err.Error())
+				}
+			}()
+		}
+
+		if err := c.Start(); err != nil {
+			if m, ok := container.InternalMessageFromError(err); ok {
+				t.Fatal(m)
+			} else {
+				t.Fatalf("cannot start container: %v", err)
+			}
+		} else if err = c.Serve(); err != nil {
+			if m, ok := container.InternalMessageFromError(err); ok {
+				t.Error(m)
+			} else {
+				t.Errorf("cannot serve setup params: %v", err)
+			}
+		}
+		<-ready
+		cancel()
+		waitCheck(t, c)
+	}
+}
+
 func TestContainerString(t *testing.T) {
-	c := container.New(t.Context(), "ldd", "/usr/bin/env")
+	c := container.NewCommand(t.Context(), container.MustAbs("/run/current-system/sw/bin/ldd"), "ldd", "/usr/bin/env")
 	c.SeccompFlags |= seccomp.AllowMultiarch
 	c.SeccompRules = seccomp.Preset(
 		seccomp.PresetExt|seccomp.PresetDenyNS|seccomp.PresetDenyTTY,
@@ -197,85 +559,176 @@ func TestContainerString(t *testing.T) {
 	}
 }
 
-func TestHelperInit(t *testing.T) {
-	if len(os.Args) != 5 || os.Args[4] != "init" {
-		return
-	}
-	container.SetOutput(hlog.Output{})
-	container.Init(hlog.Prepare, internal.InstallOutput)
-}
+const (
+	blockExitCodeInterrupt = 2
+)
 
-func TestHelperCheckContainer(t *testing.T) {
-	if len(os.Args) != 6 || os.Args[4] != "check" {
-		return
-	}
-
-	t.Run("user", func(t *testing.T) {
-		if uid := syscall.Getuid(); uid != 1000 {
-			t.Errorf("Getuid: %d, want 1000", uid)
-		}
-		if gid := syscall.Getgid(); gid != 100 {
-			t.Errorf("Getgid: %d, want 100", gid)
-		}
-	})
-	t.Run("hostname", func(t *testing.T) {
-		if name, err := os.Hostname(); err != nil {
-			t.Fatalf("cannot get hostname: %v", err)
-		} else if name != os.Args[5] {
-			t.Errorf("Hostname: %q, want %q", name, os.Args[5])
-		}
-
-		if p, err := os.ReadFile("/etc/hostname"); err != nil {
-			t.Fatalf("%v", err)
-		} else if string(p) != os.Args[5] {
-			t.Errorf("/etc/hostname: %q, want %q", string(p), os.Args[5])
-		}
-	})
-	t.Run("mount", func(t *testing.T) {
-		var mnt []*vfs.MountInfoEntry
-		if err := gob.NewDecoder(os.Stdin).Decode(&mnt); err != nil {
-			t.Fatalf("cannot receive expected mount points: %v", err)
-		}
-
-		var d *vfs.MountInfoDecoder
-		if f, err := os.Open("/proc/self/mountinfo"); err != nil {
-			t.Fatalf("cannot open mountinfo: %v", err)
-		} else {
-			d = vfs.NewMountInfoDecoder(f)
-		}
-
-		i := 0
-		for cur := range d.Entries() {
-			if i == len(mnt) {
-				t.Errorf("got more than %d entries", len(mnt))
-				break
+func init() {
+	helperCommands = append(helperCommands, func(c command.Command) {
+		c.Command("block", command.UsageInternal, func(args []string) error {
+			if _, err := os.NewFile(3, "sync").Write([]byte{0}); err != nil {
+				return fmt.Errorf("write to sync pipe: %v", err)
 			}
+			{
+				sig := make(chan os.Signal, 1)
+				signal.Notify(sig, os.Interrupt)
+				go func() { <-sig; os.Exit(blockExitCodeInterrupt) }()
+			}
+			select {}
+		})
 
-			// ugly hack but should be reliable and is less likely to false negative than comparing by parsed flags
-			cur.VfsOptstr = strings.TrimSuffix(cur.VfsOptstr, ",relatime")
-			cur.VfsOptstr = strings.TrimSuffix(cur.VfsOptstr, ",noatime")
-			mnt[i].VfsOptstr = strings.TrimSuffix(mnt[i].VfsOptstr, ",relatime")
-			mnt[i].VfsOptstr = strings.TrimSuffix(mnt[i].VfsOptstr, ",noatime")
-
-			if !cur.EqualWithIgnore(mnt[i], "\x00") {
-				t.Errorf("[FAIL] %s", cur)
+		c.Command("container", command.UsageInternal, func(args []string) error {
+			if len(args) != 1 {
+				return syscall.EINVAL
+			}
+			tc := containerTestCases[0]
+			if i, err := strconv.Atoi(args[0]); err != nil {
+				return fmt.Errorf("cannot parse test case index: %v", err)
 			} else {
-				t.Logf("[ OK ] %s", cur)
+				tc = containerTestCases[i]
 			}
 
-			i++
-		}
-		if err := d.Err(); err != nil {
-			t.Errorf("cannot parse mountinfo: %v", err)
-		}
+			if uid := syscall.Getuid(); uid != tc.uid {
+				return fmt.Errorf("uid: %d, want %d", uid, tc.uid)
+			}
+			if gid := syscall.Getgid(); gid != tc.gid {
+				return fmt.Errorf("gid: %d, want %d", gid, tc.gid)
+			}
 
-		if i != len(mnt) {
-			t.Errorf("got %d entries, want %d", i, len(mnt))
-		}
+			wantHost := hostnameFromTestCase(tc.name)
+			if host, err := os.Hostname(); err != nil {
+				return fmt.Errorf("cannot get hostname: %v", err)
+			} else if host != wantHost {
+				return fmt.Errorf("hostname: %q, want %q", host, wantHost)
+			}
+
+			if p, err := os.ReadFile("/etc/hostname"); err != nil {
+				return fmt.Errorf("cannot read /etc/hostname: %v", err)
+			} else if string(p) != wantHost {
+				return fmt.Errorf("/etc/hostname: %q, want %q", string(p), wantHost)
+			}
+
+			if _, err := os.Create(pathReadonly + "/nonexistent"); !errors.Is(err, syscall.EROFS) {
+				return err
+			}
+
+			{
+				var fail bool
+
+				var mnt []*vfs.MountInfoEntry
+				if f, err := os.Open(pathWantMnt); err != nil {
+					return fmt.Errorf("cannot open expected mount points: %v", err)
+				} else if err = gob.NewDecoder(f).Decode(&mnt); err != nil {
+					return fmt.Errorf("cannot parse expected mount points: %v", err)
+				} else if err = f.Close(); err != nil {
+					return fmt.Errorf("cannot close expected mount points: %v", err)
+				}
+
+				if tc.ro && len(mnt) > 0 {
+					// Remount("/", syscall.MS_RDONLY)
+					mnt[0].VfsOptstr = "ro,nosuid,nodev"
+				}
+
+				var d *vfs.MountInfoDecoder
+				if f, err := os.Open("/proc/self/mountinfo"); err != nil {
+					return fmt.Errorf("cannot open mountinfo: %v", err)
+				} else {
+					d = vfs.NewMountInfoDecoder(f)
+				}
+
+				i := 0
+				for cur := range d.Entries() {
+					if i == len(mnt) {
+						return fmt.Errorf("got more than %d entries", len(mnt))
+					}
+
+					// ugly hack but should be reliable and is less likely to false negative than comparing by parsed flags
+					cur.VfsOptstr = strings.TrimSuffix(cur.VfsOptstr, ",relatime")
+					cur.VfsOptstr = strings.TrimSuffix(cur.VfsOptstr, ",noatime")
+					mnt[i].VfsOptstr = strings.TrimSuffix(mnt[i].VfsOptstr, ",relatime")
+					mnt[i].VfsOptstr = strings.TrimSuffix(mnt[i].VfsOptstr, ",noatime")
+
+					if !cur.EqualWithIgnore(mnt[i], "\x00") {
+						fail = true
+						log.Printf("[FAIL] %s", cur)
+					} else {
+						log.Printf("[ OK ] %s", cur)
+					}
+
+					i++
+				}
+				if err := d.Err(); err != nil {
+					return fmt.Errorf("cannot parse mountinfo: %v", err)
+				}
+
+				if i != len(mnt) {
+					return fmt.Errorf("got %d entries, want %d", i, len(mnt))
+				}
+
+				if fail {
+					return errors.New("one or more mountinfo entries do not match")
+				}
+			}
+
+			return nil
+		})
 	})
 }
 
-func commandContext(ctx context.Context) *exec.Cmd {
-	return exec.CommandContext(ctx, os.Args[0], "-test.v",
-		"-test.run=TestHelperInit", "--", "init")
+const (
+	envDoCheck = "HAKUREI_TEST_DO_CHECK"
+
+	helperDefaultTimeout = 5 * time.Second
+	helperInnerPath      = "/usr/bin/helper"
+)
+
+var (
+	absHelperInnerPath = container.MustAbs(helperInnerPath)
+)
+
+var helperCommands []func(c command.Command)
+
+func TestMain(m *testing.M) {
+	container.TryArgv0(hlog.Output{}, hlog.Prepare, internal.InstallOutput)
+
+	if os.Getenv(envDoCheck) == "1" {
+		c := command.New(os.Stderr, log.Printf, "helper", func(args []string) error {
+			log.SetFlags(0)
+			log.SetPrefix("helper: ")
+			return nil
+		})
+		for _, f := range helperCommands {
+			f(c)
+		}
+		c.MustParse(os.Args[1:], func(err error) {
+			if err != nil {
+				log.Fatal(err.Error())
+			}
+		})
+		return
+	}
+
+	os.Exit(m.Run())
+}
+
+func helperNewContainerLibPaths(ctx context.Context, libPaths *[]*container.Absolute, args ...string) (c *container.Container) {
+	c = container.NewCommand(ctx, absHelperInnerPath, "helper", args...)
+	c.Env = append(c.Env, envDoCheck+"=1")
+	c.Bind(container.MustAbs(os.Args[0]), absHelperInnerPath, 0)
+
+	// in case test has cgo enabled
+	if entries, err := ldd.Exec(ctx, os.Args[0]); err != nil {
+		log.Fatalf("ldd: %v", err)
+	} else {
+		*libPaths = ldd.Path(entries)
+	}
+	for _, name := range *libPaths {
+		c.Bind(name, name, 0)
+	}
+
+	return
+}
+
+func helperNewContainer(ctx context.Context, args ...string) (c *container.Container) {
+	return helperNewContainerLibPaths(ctx, new([]*container.Absolute), args...)
 }

container/dispatcher.go

@@ -0,0 +1,242 @@
+package container
+
+import (
+	"io"
+	"io/fs"
+	"log"
+	"os"
+	"os/exec"
+	"os/signal"
+	"path/filepath"
+	"runtime"
+	"syscall"
+
+	"hakurei.app/container/seccomp"
+)
+
+type osFile interface {
+	Name() string
+	io.Writer
+	fs.File
+}
+
+// syscallDispatcher provides methods that make state-dependent system calls as part of their behaviour.
+type syscallDispatcher interface {
+	// new starts a goroutine with a new instance of syscallDispatcher.
+	// A syscallDispatcher must never be used in any goroutine other than the one owning it,
+	// just synchronising access is not enough, as this is for test instrumentation.
+	new(f func(k syscallDispatcher))
+
+	// lockOSThread provides [runtime.LockOSThread].
+	lockOSThread()
+
+	// setPtracer provides [SetPtracer].
+	setPtracer(pid uintptr) error
+	// setDumpable provides [SetDumpable].
+	setDumpable(dumpable uintptr) error
+	// setNoNewPrivs provides [SetNoNewPrivs].
+	setNoNewPrivs() error
+
+	// lastcap provides [LastCap].
+	lastcap() uintptr
+	// capset provides capset.
+	capset(hdrp *capHeader, datap *[2]capData) error
+	// capBoundingSetDrop provides capBoundingSetDrop.
+	capBoundingSetDrop(cap uintptr) error
+	// capAmbientClearAll provides capAmbientClearAll.
+	capAmbientClearAll() error
+	// capAmbientRaise provides capAmbientRaise.
+	capAmbientRaise(cap uintptr) error
+	// isatty provides [Isatty].
+	isatty(fd int) bool
+	// receive provides [Receive].
+	receive(key string, e any, fdp *uintptr) (closeFunc func() error, err error)
+
+	// bindMount provides procPaths.bindMount.
+	bindMount(source, target string, flags uintptr) error
+	// remount provides procPaths.remount.
+	remount(target string, flags uintptr) error
+	// mountTmpfs provides mountTmpfs.
+	mountTmpfs(fsname, target string, flags uintptr, size int, perm os.FileMode) error
+	// ensureFile provides ensureFile.
+	ensureFile(name string, perm, pperm os.FileMode) error
+
+	// seccompLoad provides [seccomp.Load].
+	seccompLoad(rules []seccomp.NativeRule, flags seccomp.ExportFlag) error
+	// notify provides [signal.Notify].
+	notify(c chan<- os.Signal, sig ...os.Signal)
+	// start starts [os/exec.Cmd].
+	start(c *exec.Cmd) error
+	// signal signals the underlying process of [os/exec.Cmd].
+	signal(c *exec.Cmd, sig os.Signal) error
+	// evalSymlinks provides [filepath.EvalSymlinks].
+	evalSymlinks(path string) (string, error)
+
+	// exit provides [os.Exit].
+	exit(code int)
+	// getpid provides [os.Getpid].
+	getpid() int
+	// stat provides [os.Stat].
+	stat(name string) (os.FileInfo, error)
+	// mkdir provides [os.Mkdir].
+	mkdir(name string, perm os.FileMode) error
+	// mkdirTemp provides [os.MkdirTemp].
+	mkdirTemp(dir, pattern string) (string, error)
+	// mkdirAll provides [os.MkdirAll].
+	mkdirAll(path string, perm os.FileMode) error
+	// readdir provides [os.ReadDir].
+	readdir(name string) ([]os.DirEntry, error)
+	// openNew provides [os.Open].
+	openNew(name string) (osFile, error)
+	// writeFile provides [os.WriteFile].
+	writeFile(name string, data []byte, perm os.FileMode) error
+	// createTemp provides [os.CreateTemp].
+	createTemp(dir, pattern string) (osFile, error)
+	// remove provides os.Remove.
+	remove(name string) error
+	// newFile provides os.NewFile.
+	newFile(fd uintptr, name string) *os.File
+	// symlink provides os.Symlink.
+	symlink(oldname, newname string) error
+	// readlink provides [os.Readlink].
+	readlink(name string) (string, error)
+
+	// umask provides syscall.Umask.
+	umask(mask int) (oldmask int)
+	// sethostname provides syscall.Sethostname
+	sethostname(p []byte) (err error)
+	// chdir provides syscall.Chdir
+	chdir(path string) (err error)
+	// fchdir provides syscall.Fchdir
+	fchdir(fd int) (err error)
+	// open provides syscall.Open
+	open(path string, mode int, perm uint32) (fd int, err error)
+	// close provides syscall.Close
+	close(fd int) (err error)
+	// pivotRoot provides syscall.PivotRoot
+	pivotRoot(newroot, putold string) (err error)
+	// mount provides syscall.Mount
+	mount(source, target, fstype string, flags uintptr, data string) (err error)
+	// unmount provides syscall.Unmount
+	unmount(target string, flags int) (err error)
+	// wait4 provides syscall.Wait4
+	wait4(pid int, wstatus *syscall.WaitStatus, options int, rusage *syscall.Rusage) (wpid int, err error)
+
+	// printf provides [log.Printf].
+	printf(format string, v ...any)
+	// fatal provides [log.Fatal]
+	fatal(v ...any)
+	// fatalf provides [log.Fatalf]
+	fatalf(format string, v ...any)
+	// verbose provides [Msg.Verbose].
+	verbose(v ...any)
+	// verbosef provides [Msg.Verbosef].
+	verbosef(format string, v ...any)
+	// suspend provides [Msg.Suspend].
+	suspend()
+	// resume provides [Msg.Resume].
+	resume() bool
+	// beforeExit provides [Msg.BeforeExit].
+	beforeExit()
+}
+
+// direct implements syscallDispatcher on the current kernel.
+type direct struct{}
+
+func (k direct) new(f func(k syscallDispatcher)) { go f(k) }
+
+func (direct) lockOSThread() { runtime.LockOSThread() }
+
+func (direct) setPtracer(pid uintptr) error       { return SetPtracer(pid) }
+func (direct) setDumpable(dumpable uintptr) error { return SetDumpable(dumpable) }
+func (direct) setNoNewPrivs() error               { return SetNoNewPrivs() }
+
+func (direct) lastcap() uintptr                                { return LastCap() }
+func (direct) capset(hdrp *capHeader, datap *[2]capData) error { return capset(hdrp, datap) }
+func (direct) capBoundingSetDrop(cap uintptr) error            { return capBoundingSetDrop(cap) }
+func (direct) capAmbientClearAll() error                       { return capAmbientClearAll() }
+func (direct) capAmbientRaise(cap uintptr) error               { return capAmbientRaise(cap) }
+func (direct) isatty(fd int) bool                              { return Isatty(fd) }
+func (direct) receive(key string, e any, fdp *uintptr) (func() error, error) {
+	return Receive(key, e, fdp)
+}
+
+func (direct) bindMount(source, target string, flags uintptr) error {
+	return hostProc.bindMount(source, target, flags)
+}
+func (direct) remount(target string, flags uintptr) error {
+	return hostProc.remount(target, flags)
+}
+func (k direct) mountTmpfs(fsname, target string, flags uintptr, size int, perm os.FileMode) error {
+	return mountTmpfs(k, fsname, target, flags, size, perm)
+}
+func (direct) ensureFile(name string, perm, pperm os.FileMode) error {
+	return ensureFile(name, perm, pperm)
+}
+
+func (direct) seccompLoad(rules []seccomp.NativeRule, flags seccomp.ExportFlag) error {
+	return seccomp.Load(rules, flags)
+}
+func (direct) notify(c chan<- os.Signal, sig ...os.Signal) { signal.Notify(c, sig...) }
+func (direct) start(c *exec.Cmd) error                     { return c.Start() }
+func (direct) signal(c *exec.Cmd, sig os.Signal) error     { return c.Process.Signal(sig) }
+func (direct) evalSymlinks(path string) (string, error)    { return filepath.EvalSymlinks(path) }
+
+func (direct) exit(code int)                                 { os.Exit(code) }
+func (direct) getpid() int                                   { return os.Getpid() }
+func (direct) stat(name string) (os.FileInfo, error)         { return os.Stat(name) }
+func (direct) mkdir(name string, perm os.FileMode) error     { return os.Mkdir(name, perm) }
+func (direct) mkdirTemp(dir, pattern string) (string, error) { return os.MkdirTemp(dir, pattern) }
+func (direct) mkdirAll(path string, perm os.FileMode) error  { return os.MkdirAll(path, perm) }
+func (direct) readdir(name string) ([]os.DirEntry, error)    { return os.ReadDir(name) }
+func (direct) openNew(name string) (osFile, error)           { return os.Open(name) }
+func (direct) writeFile(name string, data []byte, perm os.FileMode) error {
+	return os.WriteFile(name, data, perm)
+}
+func (direct) createTemp(dir, pattern string) (osFile, error) {
+	return os.CreateTemp(dir, pattern)
+}
+func (direct) remove(name string) error {
+	return os.Remove(name)
+}
+func (direct) newFile(fd uintptr, name string) *os.File {
+	return os.NewFile(fd, name)
+}
+func (direct) symlink(oldname, newname string) error {
+	return os.Symlink(oldname, newname)
+}
+func (direct) readlink(name string) (string, error) {
+	return os.Readlink(name)
+}
+
+func (direct) umask(mask int) (oldmask int)     { return syscall.Umask(mask) }
+func (direct) sethostname(p []byte) (err error) { return syscall.Sethostname(p) }
+func (direct) chdir(path string) (err error)    { return syscall.Chdir(path) }
+func (direct) fchdir(fd int) (err error)        { return syscall.Fchdir(fd) }
+func (direct) open(path string, mode int, perm uint32) (fd int, err error) {
+	return syscall.Open(path, mode, perm)
+}
+func (direct) close(fd int) (err error) {
+	return syscall.Close(fd)
+}
+func (direct) pivotRoot(newroot, putold string) (err error) {
+	return syscall.PivotRoot(newroot, putold)
+}
+func (direct) mount(source, target, fstype string, flags uintptr, data string) (err error) {
+	return mount(source, target, fstype, flags, data)
+}
+func (direct) unmount(target string, flags int) (err error) {
+	return syscall.Unmount(target, flags)
+}
+func (direct) wait4(pid int, wstatus *syscall.WaitStatus, options int, rusage *syscall.Rusage) (wpid int, err error) {
+	return syscall.Wait4(pid, wstatus, options, rusage)
+}
+
+func (direct) printf(format string, v ...any)   { log.Printf(format, v...) }
+func (direct) fatal(v ...any)                   { log.Fatal(v...) }
+func (direct) fatalf(format string, v ...any)   { log.Fatalf(format, v...) }
+func (direct) verbose(v ...any)                 { msg.Verbose(v...) }
+func (direct) verbosef(format string, v ...any) { msg.Verbosef(format, v...) }
+func (direct) suspend()                         { msg.Suspend() }
+func (direct) resume() bool                     { return msg.Resume() }
+func (direct) beforeExit()                      { msg.BeforeExit() }

container/dispatcher_test.go

@@ -0,0 +1,744 @@
+package container
+
+import (
+	"bytes"
+	"io"
+	"io/fs"
+	"os"
+	"os/exec"
+	"reflect"
+	"runtime"
+	"slices"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+
+	"hakurei.app/container/seccomp"
+	"hakurei.app/container/stub"
+)
+
+type opValidTestCase struct {
+	name string
+	op   Op
+	want bool
+}
+
+func checkOpsValid(t *testing.T, testCases []opValidTestCase) {
+	t.Helper()
+
+	t.Run("valid", func(t *testing.T) {
+		t.Helper()
+
+		for _, tc := range testCases {
+			t.Run(tc.name, func(t *testing.T) {
+				t.Helper()
+
+				if got := tc.op.Valid(); got != tc.want {
+					t.Errorf("Valid: %v, want %v", got, tc.want)
+				}
+			})
+		}
+	})
+}
+
+type opsBuilderTestCase struct {
+	name string
+	ops  *Ops
+	want Ops
+}
+
+func checkOpsBuilder(t *testing.T, testCases []opsBuilderTestCase) {
+	t.Helper()
+
+	t.Run("build", func(t *testing.T) {
+		t.Helper()
+
+		for _, tc := range testCases {
+			t.Run(tc.name, func(t *testing.T) {
+				t.Helper()
+
+				if !slices.EqualFunc(*tc.ops, tc.want, func(op Op, v Op) bool { return op.Is(v) }) {
+					t.Errorf("Ops: %#v, want %#v", tc.ops, tc.want)
+				}
+			})
+		}
+	})
+}
+
+type opIsTestCase struct {
+	name  string
+	op, v Op
+	want  bool
+}
+
+func checkOpIs(t *testing.T, testCases []opIsTestCase) {
+	t.Helper()
+
+	t.Run("is", func(t *testing.T) {
+		t.Helper()
+
+		for _, tc := range testCases {
+			t.Run(tc.name, func(t *testing.T) {
+				t.Helper()
+
+				if got := tc.op.Is(tc.v); got != tc.want {
+					t.Errorf("Is: %v, want %v", got, tc.want)
+				}
+			})
+		}
+	})
+}
+
+type opMetaTestCase struct {
+	name string
+	op   Op
+
+	wantPrefix string
+	wantString string
+}
+
+func checkOpMeta(t *testing.T, testCases []opMetaTestCase) {
+	t.Helper()
+
+	t.Run("meta", func(t *testing.T) {
+		t.Helper()
+
+		for _, tc := range testCases {
+			t.Run(tc.name, func(t *testing.T) {
+				t.Helper()
+
+				t.Run("prefix", func(t *testing.T) {
+					t.Helper()
+
+					if got, _ := tc.op.prefix(); got != tc.wantPrefix {
+						t.Errorf("prefix: %q, want %q", got, tc.wantPrefix)
+					}
+				})
+
+				t.Run("string", func(t *testing.T) {
+					t.Helper()
+
+					if got := tc.op.String(); got != tc.wantString {
+						t.Errorf("String: %s, want %s", got, tc.wantString)
+					}
+				})
+			})
+		}
+	})
+}
+
+// call initialises a [stub.Call].
+// This keeps composites analysis happy without making the test cases too bloated.
+func call(name string, args stub.ExpectArgs, ret any, err error) stub.Call {
+	return stub.Call{Name: name, Args: args, Ret: ret, Err: err}
+}
+
+type simpleTestCase struct {
+	name    string
+	f       func(k syscallDispatcher) error
+	want    stub.Expect
+	wantErr error
+}
+
+func checkSimple(t *testing.T, fname string, testCases []simpleTestCase) {
+	t.Helper()
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Helper()
+
+			wait4signal := make(chan struct{})
+			k := &kstub{wait4signal, stub.New(t, func(s *stub.Stub[syscallDispatcher]) syscallDispatcher { return &kstub{wait4signal, s} }, tc.want)}
+			defer stub.HandleExit(t)
+			if err := tc.f(k); !reflect.DeepEqual(err, tc.wantErr) {
+				t.Errorf("%s: error = %v, want %v", fname, err, tc.wantErr)
+			}
+			k.VisitIncomplete(func(s *stub.Stub[syscallDispatcher]) {
+				t.Helper()
+
+				t.Errorf("%s: %d calls, want %d", fname, s.Pos(), s.Len())
+			})
+		})
+	}
+}
+
+type opBehaviourTestCase struct {
+	name   string
+	params *Params
+	op     Op
+
+	early        []stub.Call
+	wantErrEarly error
+
+	apply        []stub.Call
+	wantErrApply error
+}
+
+func checkOpBehaviour(t *testing.T, testCases []opBehaviourTestCase) {
+	t.Helper()
+
+	t.Run("behaviour", func(t *testing.T) {
+		t.Helper()
+
+		for _, tc := range testCases {
+			t.Run(tc.name, func(t *testing.T) {
+				t.Helper()
+
+				state := &setupState{Params: tc.params}
+				k := &kstub{nil, stub.New(t,
+					func(s *stub.Stub[syscallDispatcher]) syscallDispatcher { return &kstub{nil, s} },
+					stub.Expect{Calls: slices.Concat(tc.early, []stub.Call{{Name: stub.CallSeparator}}, tc.apply)},
+				)}
+				defer stub.HandleExit(t)
+				errEarly := tc.op.early(state, k)
+				k.Expects(stub.CallSeparator)
+				if !reflect.DeepEqual(errEarly, tc.wantErrEarly) {
+					t.Errorf("early: error = %v, want %v", errEarly, tc.wantErrEarly)
+				}
+				if errEarly != nil {
+					goto out
+				}
+
+				if err := tc.op.apply(state, k); !reflect.DeepEqual(err, tc.wantErrApply) {
+					t.Errorf("apply: error = %v, want %v", err, tc.wantErrApply)
+				}
+
+			out:
+				k.VisitIncomplete(func(s *stub.Stub[syscallDispatcher]) {
+					count := k.Pos() - 1 // separator
+					if count < len(tc.early) {
+						t.Errorf("early: %d calls, want %d", count, len(tc.early))
+					} else {
+						t.Errorf("apply: %d calls, want %d", count-len(tc.early), len(tc.apply))
+					}
+				})
+			})
+		}
+	})
+}
+
+func sliceAddr[S any](s []S) *[]S { return &s }
+
+func newCheckedFile(t *testing.T, name, wantData string, closeErr error) osFile {
+	f := &checkedOsFile{t: t, name: name, want: wantData, closeErr: closeErr}
+	// check happens in Close, and cleanup is not guaranteed to run, so relying on it for sloppy implementations will cause sporadic test results
+	f.cleanup = runtime.AddCleanup(f, func(name string) { f.t.Fatalf("checkedOsFile %s became unreachable without a call to Close", name) }, f.name)
+	return f
+}
+
+type checkedOsFile struct {
+	t        *testing.T
+	name     string
+	want     string
+	closeErr error
+	cleanup  runtime.Cleanup
+	bytes.Buffer
+}
+
+func (f *checkedOsFile) Name() string               { return f.name }
+func (f *checkedOsFile) Stat() (fs.FileInfo, error) { panic("unreachable") }
+func (f *checkedOsFile) Close() error {
+	defer f.cleanup.Stop()
+	if f.String() != f.want {
+		f.t.Errorf("checkedOsFile:\n%s\nwant\n%s", f.String(), f.want)
+		return syscall.ENOTRECOVERABLE
+	}
+	return f.closeErr
+}
+
+func newConstFile(s string) osFile { return &readerOsFile{Reader: strings.NewReader(s)} }
+
+type readerOsFile struct {
+	closed bool
+	io.Reader
+}
+
+func (*readerOsFile) Name() string               { panic("unreachable") }
+func (*readerOsFile) Write([]byte) (int, error)  { panic("unreachable") }
+func (*readerOsFile) Stat() (fs.FileInfo, error) { panic("unreachable") }
+func (r *readerOsFile) Close() error {
+	if r.closed {
+		return os.ErrClosed
+	}
+	r.closed = true
+	return nil
+}
+
+type writeErrOsFile struct{ err error }
+
+func (writeErrOsFile) Name() string                { panic("unreachable") }
+func (f writeErrOsFile) Write([]byte) (int, error) { return 0, f.err }
+func (writeErrOsFile) Stat() (fs.FileInfo, error)  { panic("unreachable") }
+func (writeErrOsFile) Read([]byte) (int, error)    { panic("unreachable") }
+func (writeErrOsFile) Close() error                { panic("unreachable") }
+
+type isDirFi bool
+
+func (isDirFi) Name() string       { panic("unreachable") }
+func (isDirFi) Size() int64        { panic("unreachable") }
+func (isDirFi) Mode() fs.FileMode  { panic("unreachable") }
+func (isDirFi) ModTime() time.Time { panic("unreachable") }
+func (fi isDirFi) IsDir() bool     { return bool(fi) }
+func (isDirFi) Sys() any           { panic("unreachable") }
+
+func stubDir(names ...string) []os.DirEntry {
+	d := make([]os.DirEntry, len(names))
+	for i, name := range names {
+		d[i] = nameDentry(name)
+	}
+	return d
+}
+
+type nameDentry string
+
+func (e nameDentry) Name() string             { return string(e) }
+func (nameDentry) IsDir() bool                { panic("unreachable") }
+func (nameDentry) Type() fs.FileMode          { panic("unreachable") }
+func (nameDentry) Info() (fs.FileInfo, error) { panic("unreachable") }
+
+const (
+	// magicWait4Signal must be used in a single pair of signal and wait4 calls across two goroutines
+	// originating from the same toplevel kstub.
+	// To enable this behaviour this value must be the last element of the args field in the wait4 call
+	// and the ret value of the signal call.
+	magicWait4Signal = 0xdef
+)
+
+type kstub struct {
+	wait4signal chan struct{}
+	*stub.Stub[syscallDispatcher]
+}
+
+func (k *kstub) new(f func(k syscallDispatcher)) { k.Helper(); k.New(f) }
+
+func (k *kstub) lockOSThread() { k.Helper(); k.Expects("lockOSThread") }
+
+func (k *kstub) setPtracer(pid uintptr) error {
+	k.Helper()
+	return k.Expects("setPtracer").Error(
+		stub.CheckArg(k.Stub, "pid", pid, 0))
+}
+
+func (k *kstub) setDumpable(dumpable uintptr) error {
+	k.Helper()
+	return k.Expects("setDumpable").Error(
+		stub.CheckArg(k.Stub, "dumpable", dumpable, 0))
+}
+
+func (k *kstub) setNoNewPrivs() error { k.Helper(); return k.Expects("setNoNewPrivs").Err }
+func (k *kstub) lastcap() uintptr     { k.Helper(); return k.Expects("lastcap").Ret.(uintptr) }
+
+func (k *kstub) capset(hdrp *capHeader, datap *[2]capData) error {
+	k.Helper()
+	return k.Expects("capset").Error(
+		stub.CheckArgReflect(k.Stub, "hdrp", hdrp, 0),
+		stub.CheckArgReflect(k.Stub, "datap", datap, 1))
+}
+
+func (k *kstub) capBoundingSetDrop(cap uintptr) error {
+	k.Helper()
+	return k.Expects("capBoundingSetDrop").Error(
+		stub.CheckArg(k.Stub, "cap", cap, 0))
+}
+
+func (k *kstub) capAmbientClearAll() error { k.Helper(); return k.Expects("capAmbientClearAll").Err }
+
+func (k *kstub) capAmbientRaise(cap uintptr) error {
+	k.Helper()
+	return k.Expects("capAmbientRaise").Error(
+		stub.CheckArg(k.Stub, "cap", cap, 0))
+}
+
+func (k *kstub) isatty(fd int) bool {
+	k.Helper()
+	expect := k.Expects("isatty")
+	if !stub.CheckArg(k.Stub, "fd", fd, 0) {
+		k.FailNow()
+	}
+	return expect.Ret.(bool)
+}
+
+func (k *kstub) receive(key string, e any, fdp *uintptr) (closeFunc func() error, err error) {
+	k.Helper()
+	expect := k.Expects("receive")
+
+	var closed bool
+	closeFunc = func() error {
+		if closed {
+			k.Error("closeFunc called more than once")
+			return os.ErrClosed
+		}
+		closed = true
+
+		if expect.Ret != nil {
+			// use return stored in kexpect for closeFunc instead
+			return expect.Ret.(error)
+		}
+		return nil
+	}
+	err = expect.Error(
+		stub.CheckArg(k.Stub, "key", key, 0),
+		stub.CheckArgReflect(k.Stub, "e", e, 1),
+		stub.CheckArgReflect(k.Stub, "fdp", fdp, 2))
+
+	// 3 is unused so stores params
+	if expect.Args[3] != nil {
+		if v, ok := expect.Args[3].(*initParams); ok && v != nil {
+			if p, ok0 := e.(*initParams); ok0 && p != nil {
+				*p = *v
+			}
+		}
+	}
+
+	// 4 is unused so stores fd
+	if expect.Args[4] != nil {
+		if v, ok := expect.Args[4].(uintptr); ok && v >= 3 {
+			if fdp != nil {
+				*fdp = v
+			}
+		}
+	}
+
+	return
+}
+
+func (k *kstub) bindMount(source, target string, flags uintptr) error {
+	k.Helper()
+	return k.Expects("bindMount").Error(
+		stub.CheckArg(k.Stub, "source", source, 0),
+		stub.CheckArg(k.Stub, "target", target, 1),
+		stub.CheckArg(k.Stub, "flags", flags, 2))
+}
+
+func (k *kstub) remount(target string, flags uintptr) error {
+	k.Helper()
+	return k.Expects("remount").Error(
+		stub.CheckArg(k.Stub, "target", target, 0),
+		stub.CheckArg(k.Stub, "flags", flags, 1))
+}
+
+func (k *kstub) mountTmpfs(fsname, target string, flags uintptr, size int, perm os.FileMode) error {
+	k.Helper()
+	return k.Expects("mountTmpfs").Error(
+		stub.CheckArg(k.Stub, "fsname", fsname, 0),
+		stub.CheckArg(k.Stub, "target", target, 1),
+		stub.CheckArg(k.Stub, "flags", flags, 2),
+		stub.CheckArg(k.Stub, "size", size, 3),
+		stub.CheckArg(k.Stub, "perm", perm, 4))
+}
+
+func (k *kstub) ensureFile(name string, perm, pperm os.FileMode) error {
+	k.Helper()
+	return k.Expects("ensureFile").Error(
+		stub.CheckArg(k.Stub, "name", name, 0),
+		stub.CheckArg(k.Stub, "perm", perm, 1),
+		stub.CheckArg(k.Stub, "pperm", pperm, 2))
+}
+
+func (k *kstub) seccompLoad(rules []seccomp.NativeRule, flags seccomp.ExportFlag) error {
+	k.Helper()
+	return k.Expects("seccompLoad").Error(
+		stub.CheckArgReflect(k.Stub, "rules", rules, 0),
+		stub.CheckArg(k.Stub, "flags", flags, 1))
+}
+
+func (k *kstub) notify(c chan<- os.Signal, sig ...os.Signal) {
+	k.Helper()
+	expect := k.Expects("notify")
+	if c == nil || expect.Error(
+		stub.CheckArgReflect(k.Stub, "sig", sig, 1)) != nil {
+		k.FailNow()
+	}
+
+	// export channel for external instrumentation
+	if chanf, ok := expect.Args[0].(func(c chan<- os.Signal)); ok && chanf != nil {
+		chanf(c)
+	}
+}
+
+func (k *kstub) start(c *exec.Cmd) error {
+	k.Helper()
+	expect := k.Expects("start")
+	err := expect.Error(
+		stub.CheckArg(k.Stub, "c.Path", c.Path, 0),
+		stub.CheckArgReflect(k.Stub, "c.Args", c.Args, 1),
+		stub.CheckArgReflect(k.Stub, "c.Env", c.Env, 2),
+		stub.CheckArg(k.Stub, "c.Dir", c.Dir, 3))
+
+	if process, ok := expect.Ret.(*os.Process); ok && process != nil {
+		c.Process = process
+	}
+	return err
+}
+
+func (k *kstub) signal(c *exec.Cmd, sig os.Signal) error {
+	k.Helper()
+	expect := k.Expects("signal")
+	if v, ok := expect.Ret.(int); ok && v == magicWait4Signal {
+		if k.wait4signal == nil {
+			panic("kstub not initialised for wait4 simulation")
+		}
+		defer func() { close(k.wait4signal) }()
+	}
+	return expect.Error(
+		stub.CheckArg(k.Stub, "c.Path", c.Path, 0),
+		stub.CheckArgReflect(k.Stub, "c.Args", c.Args, 1),
+		stub.CheckArgReflect(k.Stub, "c.Env", c.Env, 2),
+		stub.CheckArg(k.Stub, "c.Dir", c.Dir, 3),
+		stub.CheckArg(k.Stub, "sig", sig, 4))
+}
+
+func (k *kstub) evalSymlinks(path string) (string, error) {
+	k.Helper()
+	expect := k.Expects("evalSymlinks")
+	return expect.Ret.(string), expect.Error(
+		stub.CheckArg(k.Stub, "path", path, 0))
+}
+
+func (k *kstub) exit(code int) {
+	k.Helper()
+	k.Expects("exit")
+	if !stub.CheckArg(k.Stub, "code", code, 0) {
+		k.FailNow()
+	}
+	panic(stub.PanicExit)
+}
+
+func (k *kstub) getpid() int { k.Helper(); return k.Expects("getpid").Ret.(int) }
+
+func (k *kstub) stat(name string) (os.FileInfo, error) {
+	k.Helper()
+	expect := k.Expects("stat")
+	return expect.Ret.(os.FileInfo), expect.Error(
+		stub.CheckArg(k.Stub, "name", name, 0))
+}
+
+func (k *kstub) mkdir(name string, perm os.FileMode) error {
+	k.Helper()
+	return k.Expects("mkdir").Error(
+		stub.CheckArg(k.Stub, "name", name, 0),
+		stub.CheckArg(k.Stub, "perm", perm, 1))
+}
+
+func (k *kstub) mkdirTemp(dir, pattern string) (string, error) {
+	k.Helper()
+	expect := k.Expects("mkdirTemp")
+	return expect.Ret.(string), expect.Error(
+		stub.CheckArg(k.Stub, "dir", dir, 0),
+		stub.CheckArg(k.Stub, "pattern", pattern, 1))
+}
+
+func (k *kstub) mkdirAll(path string, perm os.FileMode) error {
+	k.Helper()
+	return k.Expects("mkdirAll").Error(
+		stub.CheckArg(k.Stub, "path", path, 0),
+		stub.CheckArg(k.Stub, "perm", perm, 1))
+}
+
+func (k *kstub) readdir(name string) ([]os.DirEntry, error) {
+	k.Helper()
+	expect := k.Expects("readdir")
+	return expect.Ret.([]os.DirEntry), expect.Error(
+		stub.CheckArg(k.Stub, "name", name, 0))
+}
+
+func (k *kstub) openNew(name string) (osFile, error) {
+	k.Helper()
+	expect := k.Expects("openNew")
+	return expect.Ret.(osFile), expect.Error(
+		stub.CheckArg(k.Stub, "name", name, 0))
+}
+
+func (k *kstub) writeFile(name string, data []byte, perm os.FileMode) error {
+	k.Helper()
+	return k.Expects("writeFile").Error(
+		stub.CheckArg(k.Stub, "name", name, 0),
+		stub.CheckArgReflect(k.Stub, "data", data, 1),
+		stub.CheckArg(k.Stub, "perm", perm, 2))
+}
+
+func (k *kstub) createTemp(dir, pattern string) (osFile, error) {
+	k.Helper()
+	expect := k.Expects("createTemp")
+	return expect.Ret.(osFile), expect.Error(
+		stub.CheckArg(k.Stub, "dir", dir, 0),
+		stub.CheckArg(k.Stub, "pattern", pattern, 1))
+}
+
+func (k *kstub) remove(name string) error {
+	k.Helper()
+	return k.Expects("remove").Error(
+		stub.CheckArg(k.Stub, "name", name, 0))
+}
+
+func (k *kstub) newFile(fd uintptr, name string) *os.File {
+	k.Helper()
+	expect := k.Expects("newFile")
+	if expect.Error(
+		stub.CheckArg(k.Stub, "fd", fd, 0),
+		stub.CheckArg(k.Stub, "name", name, 1)) != nil {
+		k.FailNow()
+	}
+	return expect.Ret.(*os.File)
+}
+
+func (k *kstub) symlink(oldname, newname string) error {
+	k.Helper()
+	return k.Expects("symlink").Error(
+		stub.CheckArg(k.Stub, "oldname", oldname, 0),
+		stub.CheckArg(k.Stub, "newname", newname, 1))
+}
+
+func (k *kstub) readlink(name string) (string, error) {
+	k.Helper()
+	expect := k.Expects("readlink")
+	return expect.Ret.(string), expect.Error(
+		stub.CheckArg(k.Stub, "name", name, 0))
+}
+
+func (k *kstub) umask(mask int) (oldmask int) {
+	k.Helper()
+	expect := k.Expects("umask")
+	if !stub.CheckArg(k.Stub, "mask", mask, 0) {
+		k.FailNow()
+	}
+	return expect.Ret.(int)
+}
+
+func (k *kstub) sethostname(p []byte) (err error) {
+	k.Helper()
+	return k.Expects("sethostname").Error(
+		stub.CheckArgReflect(k.Stub, "p", p, 0))
+}
+
+func (k *kstub) chdir(path string) (err error) {
+	k.Helper()
+	return k.Expects("chdir").Error(
+		stub.CheckArg(k.Stub, "path", path, 0))
+}
+
+func (k *kstub) fchdir(fd int) (err error) {
+	k.Helper()
+	return k.Expects("fchdir").Error(
+		stub.CheckArg(k.Stub, "fd", fd, 0))
+}
+
+func (k *kstub) open(path string, mode int, perm uint32) (fd int, err error) {
+	k.Helper()
+	expect := k.Expects("open")
+	return expect.Ret.(int), expect.Error(
+		stub.CheckArg(k.Stub, "path", path, 0),
+		stub.CheckArg(k.Stub, "mode", mode, 1),
+		stub.CheckArg(k.Stub, "perm", perm, 2))
+}
+
+func (k *kstub) close(fd int) (err error) {
+	k.Helper()
+	return k.Expects("close").Error(
+		stub.CheckArg(k.Stub, "fd", fd, 0))
+}
+
+func (k *kstub) pivotRoot(newroot, putold string) (err error) {
+	k.Helper()
+	return k.Expects("pivotRoot").Error(
+		stub.CheckArg(k.Stub, "newroot", newroot, 0),
+		stub.CheckArg(k.Stub, "putold", putold, 1))
+}
+
+func (k *kstub) mount(source, target, fstype string, flags uintptr, data string) (err error) {
+	k.Helper()
+	return k.Expects("mount").Error(
+		stub.CheckArg(k.Stub, "source", source, 0),
+		stub.CheckArg(k.Stub, "target", target, 1),
+		stub.CheckArg(k.Stub, "fstype", fstype, 2),
+		stub.CheckArg(k.Stub, "flags", flags, 3),
+		stub.CheckArg(k.Stub, "data", data, 4))
+}
+
+func (k *kstub) unmount(target string, flags int) (err error) {
+	k.Helper()
+	return k.Expects("unmount").Error(
+		stub.CheckArg(k.Stub, "target", target, 0),
+		stub.CheckArg(k.Stub, "flags", flags, 1))
+}
+
+func (k *kstub) wait4(pid int, wstatus *syscall.WaitStatus, options int, rusage *syscall.Rusage) (wpid int, err error) {
+	k.Helper()
+	expect := k.Expects("wait4")
+	if v, ok := expect.Args[4].(int); ok {
+		switch v {
+		case stub.PanicExit: // special case to prevent leaking the wait4 goroutine while testing initEntrypoint
+			panic(stub.PanicExit)
+
+		case magicWait4Signal: // block until corresponding signal call
+			if k.wait4signal == nil {
+				panic("kstub not initialised for wait4 simulation")
+			}
+			<-k.wait4signal
+		}
+	}
+
+	wpid = expect.Ret.(int)
+	err = expect.Error(
+		stub.CheckArg(k.Stub, "pid", pid, 0),
+		stub.CheckArg(k.Stub, "options", options, 2))
+
+	if wstatusV, ok := expect.Args[1].(syscall.WaitStatus); wstatus != nil && ok {
+		*wstatus = wstatusV
+	}
+	if rusageV, ok := expect.Args[3].(syscall.Rusage); rusage != nil && ok {
+		*rusage = rusageV
+	}
+
+	return
+}
+
+func (k *kstub) printf(format string, v ...any) {
+	k.Helper()
+	if k.Expects("printf").Error(
+		stub.CheckArg(k.Stub, "format", format, 0),
+		stub.CheckArgReflect(k.Stub, "v", v, 1)) != nil {
+		k.FailNow()
+	}
+}
+
+func (k *kstub) fatal(v ...any) {
+	k.Helper()
+	if k.Expects("fatal").Error(
+		stub.CheckArgReflect(k.Stub, "v", v, 0)) != nil {
+		k.FailNow()
+	}
+	panic(stub.PanicExit)
+}
+
+func (k *kstub) fatalf(format string, v ...any) {
+	k.Helper()
+	if k.Expects("fatalf").Error(
+		stub.CheckArg(k.Stub, "format", format, 0),
+		stub.CheckArgReflect(k.Stub, "v", v, 1)) != nil {
+		k.FailNow()
+	}
+	panic(stub.PanicExit)
+}
+
+func (k *kstub) verbose(v ...any) {
+	k.Helper()
+	if k.Expects("verbose").Error(
+		stub.CheckArgReflect(k.Stub, "v", v, 0)) != nil {
+		k.FailNow()
+	}
+}
+
+func (k *kstub) verbosef(format string, v ...any) {
+	k.Helper()
+	if k.Expects("verbosef").Error(
+		stub.CheckArg(k.Stub, "format", format, 0),
+		stub.CheckArgReflect(k.Stub, "v", v, 1)) != nil {
+		k.FailNow()
+	}
+}
+
+func (k *kstub) suspend()     { k.Helper(); k.Expects("suspend") }
+func (k *kstub) resume() bool { k.Helper(); return k.Expects("resume").Ret.(bool) }
+func (k *kstub) beforeExit()  { k.Helper(); k.Expects("beforeExit") }

container/errors.go

@@ -0,0 +1,112 @@
+package container
+
+import (
+	"errors"
+	"os"
+	"syscall"
+
+	"hakurei.app/container/vfs"
+)
+
+// messageFromError returns a printable error message for a supported concrete type.
+func messageFromError(err error) (string, bool) {
+	if m, ok := messagePrefixP[MountError]("cannot ", err); ok {
+		return m, ok
+	}
+	if m, ok := messagePrefixP[os.PathError]("cannot ", err); ok {
+		return m, ok
+	}
+	if m, ok := messagePrefixP[AbsoluteError]("", err); ok {
+		return m, ok
+	}
+	if m, ok := messagePrefix[OpRepeatError]("", err); ok {
+		return m, ok
+	}
+	if m, ok := messagePrefix[OpStateError]("", err); ok {
+		return m, ok
+	}
+
+	if m, ok := messagePrefixP[vfs.DecoderError]("cannot ", err); ok {
+		return m, ok
+	}
+	if m, ok := messagePrefix[TmpfsSizeError]("", err); ok {
+		return m, ok
+	}
+
+	return zeroString, false
+}
+
+// messagePrefix checks and prefixes the error message of a non-pointer error.
+// While this is usable for pointer errors, such use should be avoided as nil check is omitted.
+func messagePrefix[T error](prefix string, err error) (string, bool) {
+	var targetError T
+	if errors.As(err, &targetError) {
+		return prefix + targetError.Error(), true
+	}
+	return zeroString, false
+}
+
+// messagePrefixP checks and prefixes the error message of a pointer error.
+func messagePrefixP[V any, T interface {
+	*V
+	error
+}](prefix string, err error) (string, bool) {
+	var targetError T
+	if errors.As(err, &targetError) && targetError != nil {
+		return prefix + targetError.Error(), true
+	}
+	return zeroString, false
+}
+
+type MountError struct {
+	Source, Target, Fstype string
+
+	Flags uintptr
+	Data  string
+	syscall.Errno
+}
+
+func (e *MountError) Unwrap() error {
+	if e.Errno == 0 {
+		return nil
+	}
+	return e.Errno
+}
+
+func (e *MountError) Error() string {
+	if e.Flags&syscall.MS_BIND != 0 {
+		if e.Flags&syscall.MS_REMOUNT != 0 {
+			return "remount " + e.Target + ": " + e.Errno.Error()
+		}
+		return "bind " + e.Source + " on " + e.Target + ": " + e.Errno.Error()
+	}
+
+	if e.Fstype != FstypeNULL {
+		return "mount " + e.Fstype + " on " + e.Target + ": " + e.Errno.Error()
+	}
+
+	// fallback case: if this is reached, the conditions for it to occur should be handled above
+	return "mount " + e.Target + ": " + e.Errno.Error()
+}
+
+// errnoFallback returns the concrete errno from an error, or a [os.PathError] fallback.
+func errnoFallback(op, path string, err error) (syscall.Errno, *os.PathError) {
+	var errno syscall.Errno
+	if !errors.As(err, &errno) {
+		return 0, &os.PathError{Op: op, Path: path, Err: err}
+	}
+	return errno, nil
+}
+
+// mount wraps syscall.Mount for error handling.
+func mount(source, target, fstype string, flags uintptr, data string) error {
+	err := syscall.Mount(source, target, fstype, flags, data)
+	if err == nil {
+		return nil
+	}
+	if errno, pathError := errnoFallback("mount", target, err); pathError != nil {
+		return pathError
+	} else {
+		return &MountError{source, target, fstype, flags, data, errno}
+	}
+}

container/errors_test.go

@@ -0,0 +1,168 @@
+package container
+
+import (
+	"errors"
+	"os"
+	"reflect"
+	"strconv"
+	"syscall"
+	"testing"
+
+	"hakurei.app/container/stub"
+	"hakurei.app/container/vfs"
+)
+
+func TestMessageFromError(t *testing.T) {
+	testCases := []struct {
+		name   string
+		err    error
+		want   string
+		wantOk bool
+	}{
+		{"mount", &MountError{
+			Source: SourceTmpfsEphemeral,
+			Target: "/sysroot/tmp",
+			Fstype: FstypeTmpfs,
+			Flags:  syscall.MS_NOSUID | syscall.MS_NODEV,
+			Data:   zeroString,
+			Errno:  syscall.EINVAL,
+		}, "cannot mount tmpfs on /sysroot/tmp: invalid argument", true},
+
+		{"path", &os.PathError{
+			Op:   "mount",
+			Path: "/sysroot",
+			Err:  stub.UniqueError(0xdeadbeef),
+		}, "cannot mount /sysroot: unique error 3735928559 injected by the test suite", true},
+
+		{"absolute", &AbsoluteError{"etc/mtab"},
+			`path "etc/mtab" is not absolute`, true},
+
+		{"repeat", OpRepeatError("autoetc"),
+			"autoetc is not repeatable", true},
+
+		{"state", OpStateError("overlay"),
+			"impossible overlay state reached", true},
+
+		{"vfs parse", &vfs.DecoderError{Op: "parse", Line: 0xdeadbeef, Err: &strconv.NumError{Func: "Atoi", Num: "meow", Err: strconv.ErrSyntax}},
+			`cannot parse mountinfo at line 3735928559: numeric field "meow" invalid syntax`, true},
+
+		{"tmpfs", TmpfsSizeError(-1),
+			"tmpfs size -1 out of bounds", true},
+
+		{"unsupported", stub.UniqueError(0xdeadbeef), zeroString, false},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			got, ok := messageFromError(tc.err)
+			if got != tc.want {
+				t.Errorf("messageFromError: %q, want %q", got, tc.want)
+			}
+			if ok != tc.wantOk {
+				t.Errorf("messageFromError: ok = %v, want %v", ok, tc.wantOk)
+			}
+		})
+	}
+}
+
+func TestMountError(t *testing.T) {
+	testCases := []struct {
+		name  string
+		err   error
+		errno syscall.Errno
+		want  string
+	}{
+		{"bind", &MountError{
+			Source: "/host/nix/store",
+			Target: "/sysroot/nix/store",
+			Fstype: FstypeNULL,
+			Flags:  syscall.MS_SILENT | syscall.MS_BIND | syscall.MS_REC,
+			Data:   zeroString,
+			Errno:  syscall.ENOSYS,
+		}, syscall.ENOSYS,
+			"bind /host/nix/store on /sysroot/nix/store: function not implemented"},
+
+		{"remount", &MountError{
+			Source: SourceNone,
+			Target: "/sysroot/nix/store",
+			Fstype: FstypeNULL,
+			Flags:  syscall.MS_SILENT | syscall.MS_BIND | syscall.MS_REMOUNT,
+			Data:   zeroString,
+			Errno:  syscall.EPERM,
+		}, syscall.EPERM,
+			"remount /sysroot/nix/store: operation not permitted"},
+
+		{"overlay", &MountError{
+			Source: SourceOverlay,
+			Target: sysrootPath,
+			Fstype: FstypeOverlay,
+			Data:   `lowerdir=/host/var/lib/planterette/base/debian\:f92c9052`,
+			Errno:  syscall.EINVAL,
+		}, syscall.EINVAL,
+			"mount overlay on /sysroot: invalid argument"},
+
+		{"fallback", &MountError{
+			Source: SourceNone,
+			Target: sysrootPath,
+			Fstype: FstypeNULL,
+			Errno:  syscall.ENOTRECOVERABLE,
+		}, syscall.ENOTRECOVERABLE,
+			"mount /sysroot: state not recoverable"},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Run("is", func(t *testing.T) {
+				if !errors.Is(tc.err, tc.errno) {
+					t.Errorf("Is: %#v is not %v", tc.err, tc.errno)
+				}
+			})
+			t.Run("error", func(t *testing.T) {
+				if got := tc.err.Error(); got != tc.want {
+					t.Errorf("Error: %q, want %q", got, tc.want)
+				}
+			})
+		})
+	}
+
+	t.Run("zero", func(t *testing.T) {
+		if errors.Is(new(MountError), syscall.Errno(0)) {
+			t.Errorf("Is: zero MountError unexpected true")
+		}
+	})
+}
+
+func TestErrnoFallback(t *testing.T) {
+	testCases := []struct {
+		name      string
+		err       error
+		wantErrno syscall.Errno
+		wantPath  *os.PathError
+	}{
+		{"mount", &MountError{
+			Errno: syscall.ENOTRECOVERABLE,
+		}, syscall.ENOTRECOVERABLE, nil},
+
+		{"path errno", &os.PathError{
+			Err: syscall.ETIMEDOUT,
+		}, syscall.ETIMEDOUT, nil},
+
+		{"fallback", stub.UniqueError(0xcafebabe), 0, &os.PathError{
+			Op:   "fallback",
+			Path: "/proc/nonexistent",
+			Err:  stub.UniqueError(0xcafebabe),
+		}},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			errno, err := errnoFallback(tc.name, Nonexistent, tc.err)
+			if errno != tc.wantErrno {
+				t.Errorf("errnoFallback: errno = %v, want %v", errno, tc.wantErrno)
+			}
+			if !reflect.DeepEqual(err, tc.wantPath) {
+				t.Errorf("errnoFallback: pathError = %#v, want %#v", err, tc.wantPath)
+			}
+		})
+	}
+}
+
+// InternalMessageFromError exports messageFromError for other tests.
+func InternalMessageFromError(err error) (string, bool) { return messageFromError(err) }

container/init.go

@@ -3,12 +3,10 @@ package container
 import (
 	"errors"
 	"fmt"
-	"log"
 	"os"
 	"os/exec"
-	"os/signal"
 	"path"
-	"runtime"
+	"slices"
 	"strconv"
 	. "syscall"
 	"time"
@@ -17,9 +15,6 @@ import (
 )
 
 const (
-	// time to wait for linger processes after death of initial process
-	residualProcessTimeout = 5 * time.Second
-
 	/* intermediate tmpfs mount point
 
 	this path might seem like a weird choice, however there are many good reasons to use it:
@@ -34,12 +29,58 @@ const (
 
 	it should be noted that none of this should become relevant at any point since the resulting
 	intermediate root tmpfs should be effectively anonymous */
-	intermediateHostPath = "/proc/self/fd"
+	intermediateHostPath = FHSProc + "self/fd"
 
 	// setup params file descriptor
 	setupEnv = "HAKUREI_SETUP"
 )
 
+type (
+	// Ops is a collection of [Op].
+	Ops []Op
+
+	// Op is a generic setup step ran inside the container init.
+	// Implementations of this interface are sent as a stream of gobs.
+	Op interface {
+		// early is called in host root.
+		early(state *setupState, k syscallDispatcher) error
+		// apply is called in intermediate root.
+		apply(state *setupState, k syscallDispatcher) error
+
+		// prefix returns a log message prefix, and whether this Op prints no identifying message on its own.
+		prefix() (string, bool)
+
+		Is(op Op) bool
+		Valid() bool
+		fmt.Stringer
+	}
+
+	// setupState persists context between Ops.
+	setupState struct {
+		nonrepeatable uintptr
+		*Params
+	}
+)
+
+// Grow grows the slice Ops points to using [slices.Grow].
+func (f *Ops) Grow(n int) { *f = slices.Grow(*f, n) }
+
+const (
+	nrAutoEtc = 1 << iota
+	nrAutoRoot
+)
+
+// OpRepeatError is returned applying a repeated nonrepeatable [Op].
+type OpRepeatError string
+
+func (e OpRepeatError) Error() string { return string(e) + " is not repeatable" }
+
+// OpStateError indicates an impossible internal state has been reached in an [Op].
+type OpStateError string
+
+func (o OpStateError) Error() string { return "impossible " + string(o) + " state reached" }
+
+// initParams are params passed from parent.
 type initParams struct {
 	Params
 
@@ -50,180 +91,199 @@ type initParams struct {
 	Verbose bool
 }
 
-func Init(prepare func(prefix string), setVerbose func(verbose bool)) {
-	runtime.LockOSThread()
-	prepare("init")
+func Init(prepareLogger func(prefix string), setVerbose func(verbose bool)) {
+	initEntrypoint(direct{}, prepareLogger, setVerbose)
+}
 
-	if os.Getpid() != 1 {
-		log.Fatal("this process must run as pid 1")
+func initEntrypoint(k syscallDispatcher, prepareLogger func(prefix string), setVerbose func(verbose bool)) {
+	k.lockOSThread()
+	prepareLogger("init")
+
+	if k.getpid() != 1 {
+		k.fatal("this process must run as pid 1")
+	}
+
+	if err := k.setPtracer(0); err != nil {
+		k.verbosef("cannot enable ptrace protection via Yama LSM: %v", err)
+		// not fatal: this program has no additional privileges at initial program start
 	}
 
 	var (
 		params      initParams
 		closeSetup  func() error
-		setupFile   *os.File
+		setupFd     uintptr
 		offsetSetup int
 	)
-	if f, err := Receive(setupEnv, &params, &setupFile); err != nil {
-		if errors.Is(err, ErrInvalid) {
-			log.Fatal("invalid setup descriptor")
+	if f, err := k.receive(setupEnv, &params, &setupFd); err != nil {
+		if errors.Is(err, EBADF) {
+			k.fatal("invalid setup descriptor")
 		}
-		if errors.Is(err, ErrNotSet) {
-			log.Fatal("HAKUREI_SETUP not set")
+		if errors.Is(err, ErrReceiveEnv) {
+			k.fatal("HAKUREI_SETUP not set")
 		}
 
-		log.Fatalf("cannot decode init setup payload: %v", err)
+		k.fatalf("cannot decode init setup payload: %v", err)
 	} else {
 		if params.Ops == nil {
-			log.Fatal("invalid setup parameters")
+			k.fatal("invalid setup parameters")
 		}
 		if params.ParentPerm == 0 {
 			params.ParentPerm = 0755
 		}
 
 		setVerbose(params.Verbose)
-		msg.Verbose("received setup parameters")
+		k.verbose("received setup parameters")
 		closeSetup = f
-		offsetSetup = int(setupFile.Fd() + 1)
+		offsetSetup = int(setupFd + 1)
 	}
 
 	// write uid/gid map here so parent does not need to set dumpable
-	if err := SetDumpable(SUID_DUMP_USER); err != nil {
-		log.Fatalf("cannot set SUID_DUMP_USER: %s", err)
+	if err := k.setDumpable(SUID_DUMP_USER); err != nil {
+		k.fatalf("cannot set SUID_DUMP_USER: %v", err)
 	}
-	if err := os.WriteFile("/proc/self/uid_map",
+	if err := k.writeFile(FHSProc+"self/uid_map",
 		append([]byte{}, strconv.Itoa(params.Uid)+" "+strconv.Itoa(params.HostUid)+" 1\n"...),
 		0); err != nil {
-		log.Fatalf("%v", err)
+		k.fatalf("%v", err)
 	}
-	if err := os.WriteFile("/proc/self/setgroups",
+	if err := k.writeFile(FHSProc+"self/setgroups",
 		[]byte("deny\n"),
 		0); err != nil && !os.IsNotExist(err) {
-		log.Fatalf("%v", err)
+		k.fatalf("%v", err)
 	}
-	if err := os.WriteFile("/proc/self/gid_map",
+	if err := k.writeFile(FHSProc+"self/gid_map",
 		append([]byte{}, strconv.Itoa(params.Gid)+" "+strconv.Itoa(params.HostGid)+" 1\n"...),
 		0); err != nil {
-		log.Fatalf("%v", err)
+		k.fatalf("%v", err)
 	}
-	if err := SetDumpable(SUID_DUMP_DISABLE); err != nil {
-		log.Fatalf("cannot set SUID_DUMP_DISABLE: %s", err)
+	if err := k.setDumpable(SUID_DUMP_DISABLE); err != nil {
+		k.fatalf("cannot set SUID_DUMP_DISABLE: %v", err)
 	}
 
-	oldmask := Umask(0)
+	oldmask := k.umask(0)
 	if params.Hostname != "" {
-		if err := Sethostname([]byte(params.Hostname)); err != nil {
-			log.Fatalf("cannot set hostname: %v", err)
+		if err := k.sethostname([]byte(params.Hostname)); err != nil {
+			k.fatalf("cannot set hostname: %v", err)
 		}
 	}
 
 	// cache sysctl before pivot_root
-	LastCap()
+	lastcap := k.lastcap()
 
-	if err := Mount("", "/", "", MS_SILENT|MS_SLAVE|MS_REC, ""); err != nil {
-		log.Fatalf("cannot make / rslave: %v", err)
+	if err := k.mount(zeroString, FHSRoot, zeroString, MS_SILENT|MS_SLAVE|MS_REC, zeroString); err != nil {
+		k.fatalf("cannot make / rslave: %v", err)
 	}
 
+	state := &setupState{Params: &params.Params}
+
+	/* early is called right before pivot_root into intermediate root;
+	this step is mostly for gathering information that would otherwise be difficult to obtain
+	via library functions after pivot_root, and implementations are expected to avoid changing
+	the state of the mount namespace */
 	for i, op := range *params.Ops {
-		if op == nil {
-			log.Fatalf("invalid op %d", i)
+		if op == nil || !op.Valid() {
+			k.fatalf("invalid op at index %d", i)
 		}
 
-		if err := op.early(&params.Params); err != nil {
-			msg.PrintBaseErr(err,
-				fmt.Sprintf("cannot prepare op %d:", i))
-			msg.BeforeExit()
-			os.Exit(1)
+		if err := op.early(state, k); err != nil {
+			if m, ok := messageFromError(err); ok {
+				k.fatal(m)
+			} else {
+				k.fatalf("cannot prepare op at index %d: %v", i, err)
+			}
 		}
 	}
 
-	if err := Mount("rootfs", intermediateHostPath, "tmpfs", MS_NODEV|MS_NOSUID, ""); err != nil {
-		log.Fatalf("cannot mount intermediate root: %v", err)
+	if err := k.mount(SourceTmpfsRootfs, intermediateHostPath, FstypeTmpfs, MS_NODEV|MS_NOSUID, zeroString); err != nil {
+		k.fatalf("cannot mount intermediate root: %v", err)
 	}
-	if err := os.Chdir(intermediateHostPath); err != nil {
-		log.Fatalf("cannot enter base path: %v", err)
+	if err := k.chdir(intermediateHostPath); err != nil {
+		k.fatalf("cannot enter intermediate host path: %v", err)
 	}
 
-	if err := os.Mkdir(sysrootDir, 0755); err != nil {
-		log.Fatalf("%v", err)
+	if err := k.mkdir(sysrootDir, 0755); err != nil {
+		k.fatalf("%v", err)
 	}
-	if err := Mount(sysrootDir, sysrootDir, "", MS_SILENT|MS_MGC_VAL|MS_BIND|MS_REC, ""); err != nil {
-		log.Fatalf("cannot bind sysroot: %v", err)
+	if err := k.mount(sysrootDir, sysrootDir, zeroString, MS_SILENT|MS_BIND|MS_REC, zeroString); err != nil {
+		k.fatalf("cannot bind sysroot: %v", err)
 	}
 
-	if err := os.Mkdir(hostDir, 0755); err != nil {
-		log.Fatalf("%v", err)
+	if err := k.mkdir(hostDir, 0755); err != nil {
+		k.fatalf("%v", err)
 	}
 	// pivot_root uncovers intermediateHostPath in hostDir
-	if err := PivotRoot(intermediateHostPath, hostDir); err != nil {
-		log.Fatalf("cannot pivot into intermediate root: %v", err)
+	if err := k.pivotRoot(intermediateHostPath, hostDir); err != nil {
+		k.fatalf("cannot pivot into intermediate root: %v", err)
 	}
-	if err := os.Chdir("/"); err != nil {
-		log.Fatalf("%v", err)
+	if err := k.chdir(FHSRoot); err != nil {
+		k.fatalf("cannot enter intermediate root: %v", err)
 	}
 
+	/* apply is called right after pivot_root and entering the new root;
+	this step sets up the container filesystem, and implementations are expected to keep the host root
+	and sysroot mount points intact but otherwise can do whatever they need to;
+	chdir is allowed but discouraged */
 	for i, op := range *params.Ops {
 		// ops already checked during early setup
-		msg.Verbosef("%s %s", op.prefix(), op)
-		if err := op.apply(&params.Params); err != nil {
-			msg.PrintBaseErr(err,
-				fmt.Sprintf("cannot apply op %d:", i))
-			msg.BeforeExit()
-			os.Exit(1)
+		if prefix, ok := op.prefix(); ok {
+			k.verbosef("%s %s", prefix, op)
+		}
+		if err := op.apply(state, k); err != nil {
+			if m, ok := messageFromError(err); ok {
+				k.fatal(m)
+			} else {
+				k.fatalf("cannot apply op at index %d: %v", i, err)
+			}
 		}
 	}
 
 	// setup requiring host root complete at this point
-	if err := Mount(hostDir, hostDir, "", MS_SILENT|MS_REC|MS_PRIVATE, ""); err != nil {
-		log.Fatalf("cannot make host root rprivate: %v", err)
+	if err := k.mount(hostDir, hostDir, zeroString, MS_SILENT|MS_REC|MS_PRIVATE, zeroString); err != nil {
+		k.fatalf("cannot make host root rprivate: %v", err)
 	}
-	if err := Unmount(hostDir, MNT_DETACH); err != nil {
-		log.Fatalf("cannot unmount host root: %v", err)
+	if err := k.unmount(hostDir, MNT_DETACH); err != nil {
+		k.fatalf("cannot unmount host root: %v", err)
 	}
 
 	{
 		var fd int
 		if err := IgnoringEINTR(func() (err error) {
-			fd, err = Open("/", O_DIRECTORY|O_RDONLY, 0)
+			fd, err = k.open(FHSRoot, O_DIRECTORY|O_RDONLY, 0)
 			return
 		}); err != nil {
-			log.Fatalf("cannot open intermediate root: %v", err)
+			k.fatalf("cannot open intermediate root: %v", err)
 		}
-		if err := os.Chdir(sysrootPath); err != nil {
-			log.Fatalf("%v", err)
+		if err := k.chdir(sysrootPath); err != nil {
+			k.fatalf("cannot enter sysroot: %v", err)
 		}
 
-		if err := PivotRoot(".", "."); err != nil {
-			log.Fatalf("cannot pivot into sysroot: %v", err)
+		if err := k.pivotRoot(".", "."); err != nil {
+			k.fatalf("cannot pivot into sysroot: %v", err)
 		}
-		if err := Fchdir(fd); err != nil {
-			log.Fatalf("cannot re-enter intermediate root: %v", err)
+		if err := k.fchdir(fd); err != nil {
+			k.fatalf("cannot re-enter intermediate root: %v", err)
 		}
-		if err := Unmount(".", MNT_DETACH); err != nil {
-			log.Fatalf("cannot unmount intemediate root: %v", err)
+		if err := k.unmount(".", MNT_DETACH); err != nil {
+			k.fatalf("cannot unmount intermediate root: %v", err)
 		}
-		if err := os.Chdir("/"); err != nil {
-			log.Fatalf("%v", err)
+		if err := k.chdir(FHSRoot); err != nil {
+			k.fatalf("cannot enter root: %v", err)
 		}
 
-		if err := Close(fd); err != nil {
-			log.Fatalf("cannot close intermediate root: %v", err)
+		if err := k.close(fd); err != nil {
+			k.fatalf("cannot close intermediate root: %v", err)
 		}
 	}
 
-	if _, _, errno := Syscall(SYS_PRCTL, PR_SET_NO_NEW_PRIVS, 1, 0); errno != 0 {
-		log.Fatalf("prctl(PR_SET_NO_NEW_PRIVS): %v", errno)
+	if err := k.capAmbientClearAll(); err != nil {
+		k.fatalf("cannot clear the ambient capability set: %v", err)
 	}
-
-	if _, _, errno := Syscall(SYS_PRCTL, PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0); errno != 0 {
-		log.Fatalf("cannot clear the ambient capability set: %v", errno)
-	}
-	for i := uintptr(0); i <= LastCap(); i++ {
+	for i := uintptr(0); i <= lastcap; i++ {
 		if params.Privileged && i == CAP_SYS_ADMIN {
 			continue
 		}
-		if _, _, errno := Syscall(SYS_PRCTL, PR_CAPBSET_DROP, i, 0); errno != 0 {
-			log.Fatalf("cannot drop capability from bonding set: %v", errno)
+		if err := k.capBoundingSetDrop(i); err != nil {
+			k.fatalf("cannot drop capability from bounding set: %v", err)
 		}
 	}
 
@@ -231,52 +291,54 @@ func Init(prepare func(prefix string), setVerbose func(verbose bool)) {
 	if params.Privileged {
 		keep[capToIndex(CAP_SYS_ADMIN)] |= capToMask(CAP_SYS_ADMIN)
 
-		if _, _, errno := Syscall(SYS_PRCTL, PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, CAP_SYS_ADMIN); errno != 0 {
-			log.Fatalf("cannot raise CAP_SYS_ADMIN: %v", errno)
+		if err := k.capAmbientRaise(CAP_SYS_ADMIN); err != nil {
+			k.fatalf("cannot raise CAP_SYS_ADMIN: %v", err)
 		}
 	}
-	if err := capset(
+	if err := k.capset(
 		&capHeader{_LINUX_CAPABILITY_VERSION_3, 0},
 		&[2]capData{{0, keep[0], keep[0]}, {0, keep[1], keep[1]}},
 	); err != nil {
-		log.Fatalf("cannot capset: %v", err)
+		k.fatalf("cannot capset: %v", err)
 	}
 
 	if !params.SeccompDisable {
 		rules := params.SeccompRules
 		if len(rules) == 0 { // non-empty rules slice always overrides presets
-			msg.Verbosef("resolving presets %#x", params.SeccompPresets)
+			k.verbosef("resolving presets %#x", params.SeccompPresets)
 			rules = seccomp.Preset(params.SeccompPresets, params.SeccompFlags)
 		}
-		if err := seccomp.Load(rules, params.SeccompFlags); err != nil {
-			log.Fatalf("cannot load syscall filter: %v", err)
+		if err := k.seccompLoad(rules, params.SeccompFlags); err != nil {
+			// this also indirectly asserts PR_SET_NO_NEW_PRIVS
+			k.fatalf("cannot load syscall filter: %v", err)
 		}
-		msg.Verbosef("%d filter rules loaded", len(rules))
+		k.verbosef("%d filter rules loaded", len(rules))
 	} else {
-		msg.Verbose("syscall filter not configured")
+		k.verbose("syscall filter not configured")
 	}
 
 	extraFiles := make([]*os.File, params.Count)
 	for i := range extraFiles {
 		// setup fd is placed before all extra files
-		extraFiles[i] = os.NewFile(uintptr(offsetSetup+i), "extra file "+strconv.Itoa(i))
+		extraFiles[i] = k.newFile(uintptr(offsetSetup+i), "extra file "+strconv.Itoa(i))
 	}
-	Umask(oldmask)
+	k.umask(oldmask)
 
-	cmd := exec.Command(params.Path)
+	cmd := exec.Command(params.Path.String())
 	cmd.Stdin, cmd.Stdout, cmd.Stderr = os.Stdin, os.Stdout, os.Stderr
 	cmd.Args = params.Args
 	cmd.Env = params.Env
 	cmd.ExtraFiles = extraFiles
-	cmd.Dir = params.Dir
+	cmd.Dir = params.Dir.String()
 
-	if err := cmd.Start(); err != nil {
-		log.Fatalf("%v", err)
+	k.verbosef("starting initial program %s", params.Path)
+	if err := k.start(cmd); err != nil {
+		k.fatalf("%v", err)
 	}
-	msg.Suspend()
+	k.suspend()
 
 	if err := closeSetup(); err != nil {
-		log.Println("cannot close setup pipe:", err)
+		k.printf("cannot close setup pipe: %v", err)
 		// not fatal
 	}
 
@@ -287,7 +349,7 @@ func Init(prepare func(prefix string), setVerbose func(verbose bool)) {
 	info := make(chan winfo, 1)
 	done := make(chan struct{})
 
-	go func() {
+	k.new(func(k syscallDispatcher) {
 		var (
 			err     error
 			wpid    = -2
@@ -306,19 +368,19 @@ func Init(prepare func(prefix string), setVerbose func(verbose bool)) {
 
 			err = EINTR
 			for errors.Is(err, EINTR) {
-				wpid, err = Wait4(-1, &wstatus, 0, nil)
+				wpid, err = k.wait4(-1, &wstatus, 0, nil)
 			}
 		}
 		if !errors.Is(err, ECHILD) {
-			log.Println("unexpected wait4 response:", err)
+			k.printf("unexpected wait4 response: %v", err)
 		}
 
 		close(done)
-	}()
+	})
 
 	// handle signals to dump withheld messages
 	sig := make(chan os.Signal, 2)
-	signal.Notify(sig, SIGINT, SIGTERM)
+	k.notify(sig, os.Interrupt, CancelSignal)
 
 	// closed after residualProcessTimeout has elapsed after initial process death
 	timeout := make(chan struct{})
@@ -327,48 +389,60 @@ func Init(prepare func(prefix string), setVerbose func(verbose bool)) {
 	for {
 		select {
 		case s := <-sig:
-			if msg.Resume() {
-				msg.Verbosef("terminating on %s after process start", s.String())
+			if k.resume() {
+				k.verbosef("%s after process start", s.String())
 			} else {
-				msg.Verbosef("terminating on %s", s.String())
+				k.verbosef("got %s", s.String())
 			}
-			os.Exit(0)
+			if s == CancelSignal && params.ForwardCancel && cmd.Process != nil {
+				k.verbose("forwarding context cancellation")
+				if err := k.signal(cmd, os.Interrupt); err != nil {
+					k.printf("cannot forward cancellation: %v", err)
+				}
+				continue
+			}
+			k.beforeExit()
+			k.exit(0)
+
 		case w := <-info:
 			if w.wpid == cmd.Process.Pid {
 				// initial process exited, output is most likely available again
-				msg.Resume()
+				k.resume()
 
 				switch {
 				case w.wstatus.Exited():
 					r = w.wstatus.ExitStatus()
-					msg.Verbosef("initial process exited with code %d", w.wstatus.ExitStatus())
+					k.verbosef("initial process exited with code %d", w.wstatus.ExitStatus())
+
 				case w.wstatus.Signaled():
 					r = 128 + int(w.wstatus.Signal())
-					msg.Verbosef("initial process exited with signal %s", w.wstatus.Signal())
+					k.verbosef("initial process exited with signal %s", w.wstatus.Signal())
+
 				default:
 					r = 255
-					msg.Verbosef("initial process exited with status %#x", w.wstatus)
+					k.verbosef("initial process exited with status %#x", w.wstatus)
 				}
 
-				go func() {
-					time.Sleep(residualProcessTimeout)
-					close(timeout)
-				}()
+				go func() { time.Sleep(params.AdoptWaitDelay); close(timeout) }()
 			}
+
 		case <-done:
-			msg.BeforeExit()
-			os.Exit(r)
+			k.beforeExit()
+			k.exit(r)
+
 		case <-timeout:
-			log.Println("timeout exceeded waiting for lingering processes")
-			msg.BeforeExit()
-			os.Exit(r)
+			k.printf("timeout exceeded waiting for lingering processes")
+			k.beforeExit()
+			k.exit(r)
 		}
 	}
 }
 
+const initName = "init"
+
 // TryArgv0 calls [Init] if the last element of argv0 is "init".
 func TryArgv0(v Msg, prepare func(prefix string), setVerbose func(verbose bool)) {
-	if len(os.Args) > 0 && path.Base(os.Args[0]) == "init" {
+	if len(os.Args) > 0 && path.Base(os.Args[0]) == initName {
 		msg = v
 		Init(prepare, setVerbose)
 		msg.BeforeExit()

container/initbind.go

@@ -0,0 +1,118 @@
+package container
+
+import (
+	"encoding/gob"
+	"fmt"
+	"os"
+	"syscall"
+)
+
+func init() { gob.Register(new(BindMountOp)) }
+
+// Bind appends an [Op] that bind mounts host path [BindMountOp.Source] on container path [BindMountOp.Target].
+func (f *Ops) Bind(source, target *Absolute, flags int) *Ops {
+	*f = append(*f, &BindMountOp{nil, source, target, flags})
+	return f
+}
+
+// BindMountOp bind mounts host path Source on container path Target.
+// Note that Flags uses bits declared in this package and should not be set with constants in [syscall].
+type BindMountOp struct {
+	sourceFinal, Source, Target *Absolute
+
+	Flags int
+}
+
+const (
+	// BindOptional skips nonexistent host paths.
+	BindOptional = 1 << iota
+	// BindWritable mounts filesystem read-write.
+	BindWritable
+	// BindDevice allows access to devices (special files) on this filesystem.
+	BindDevice
+	// BindEnsure attempts to create the host path if it does not exist.
+	BindEnsure
+)
+
+func (b *BindMountOp) Valid() bool {
+	return b != nil &&
+		b.Source != nil && b.Target != nil &&
+		b.Flags&(BindOptional|BindEnsure) != (BindOptional|BindEnsure)
+}
+
+func (b *BindMountOp) early(_ *setupState, k syscallDispatcher) error {
+	if b.Flags&BindEnsure != 0 {
+		if err := k.mkdirAll(b.Source.String(), 0700); err != nil {
+			return err
+		}
+	}
+
+	if pathname, err := k.evalSymlinks(b.Source.String()); err != nil {
+		if os.IsNotExist(err) && b.Flags&BindOptional != 0 {
+			// leave sourceFinal as nil
+			return nil
+		}
+		return err
+	} else {
+		b.sourceFinal, err = NewAbs(pathname)
+		return err
+	}
+}
+
+func (b *BindMountOp) apply(_ *setupState, k syscallDispatcher) error {
+	if b.sourceFinal == nil {
+		if b.Flags&BindOptional == 0 {
+			// unreachable
+			return OpStateError("bind")
+		}
+		return nil
+	}
+
+	source := toHost(b.sourceFinal.String())
+	target := toSysroot(b.Target.String())
+
+	// this perm value emulates bwrap behaviour as it clears bits from 0755 based on
+	// op->perms which is never set for any bind setup op so always results in 0700
+	if fi, err := k.stat(source); err != nil {
+		return err
+	} else if fi.IsDir() {
+		if err = k.mkdirAll(target, 0700); err != nil {
+			return err
+		}
+	} else if err = k.ensureFile(target, 0444, 0700); err != nil {
+		return err
+	}
+
+	var flags uintptr = syscall.MS_REC
+	if b.Flags&BindWritable == 0 {
+		flags |= syscall.MS_RDONLY
+	}
+	if b.Flags&BindDevice == 0 {
+		flags |= syscall.MS_NODEV
+	}
+
+	if b.sourceFinal.String() == b.Target.String() {
+		k.verbosef("mounting %q flags %#x", target, flags)
+	} else {
+		k.verbosef("mounting %q on %q flags %#x", source, target, flags)
+	}
+	return k.bindMount(source, target, flags)
+}
+
+func (b *BindMountOp) Is(op Op) bool {
+	vb, ok := op.(*BindMountOp)
+	return ok && b.Valid() && vb.Valid() &&
+		b.Source.Is(vb.Source) &&
+		b.Target.Is(vb.Target) &&
+		b.Flags == vb.Flags
+}
+func (*BindMountOp) prefix() (string, bool) { return "mounting", false }
+func (b *BindMountOp) String() string {
+	if b.Source == nil || b.Target == nil {
+		return "<invalid>"
+	}
+	if b.Source.String() == b.Target.String() {
+		return fmt.Sprintf("%q flags %#x", b.Source, b.Flags)
+	}
+	return fmt.Sprintf("%q on %q flags %#x", b.Source, b.Target, b.Flags)
+}

container/initbind_test.go

@@ -0,0 +1,255 @@
+package container
+
+import (
+	"errors"
+	"os"
+	"syscall"
+	"testing"
+
+	"hakurei.app/container/stub"
+)
+
+func TestBindMountOp(t *testing.T) {
+	checkOpBehaviour(t, []opBehaviourTestCase{
+		{"ENOENT not optional", new(Params), &BindMountOp{
+			Source: MustAbs("/bin/"),
+			Target: MustAbs("/bin/"),
+		}, []stub.Call{
+			call("evalSymlinks", stub.ExpectArgs{"/bin/"}, "", syscall.ENOENT),
+		}, syscall.ENOENT, nil, nil},
+
+		{"skip optional", new(Params), &BindMountOp{
+			Source: MustAbs("/bin/"),
+			Target: MustAbs("/bin/"),
+			Flags:  BindOptional,
+		}, []stub.Call{
+			call("evalSymlinks", stub.ExpectArgs{"/bin/"}, "", syscall.ENOENT),
+		}, nil, nil, nil},
+
+		{"success optional", new(Params), &BindMountOp{
+			Source: MustAbs("/bin/"),
+			Target: MustAbs("/bin/"),
+			Flags:  BindOptional,
+		}, []stub.Call{
+			call("evalSymlinks", stub.ExpectArgs{"/bin/"}, "/usr/bin", nil),
+		}, nil, []stub.Call{
+			call("stat", stub.ExpectArgs{"/host/usr/bin"}, isDirFi(true), nil),
+			call("mkdirAll", stub.ExpectArgs{"/sysroot/bin", os.FileMode(0700)}, nil, nil),
+			call("verbosef", stub.ExpectArgs{"mounting %q on %q flags %#x", []any{"/host/usr/bin", "/sysroot/bin", uintptr(0x4005)}}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/usr/bin", "/sysroot/bin", uintptr(0x4005), false}, nil, nil),
+		}, nil},
+
+		{"ensureFile device", new(Params), &BindMountOp{
+			Source: MustAbs("/dev/null"),
+			Target: MustAbs("/dev/null"),
+			Flags:  BindWritable | BindDevice,
+		}, []stub.Call{
+			call("evalSymlinks", stub.ExpectArgs{"/dev/null"}, "/dev/null", nil),
+		}, nil, []stub.Call{
+			call("stat", stub.ExpectArgs{"/host/dev/null"}, isDirFi(false), nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/null", os.FileMode(0444), os.FileMode(0700)}, nil, stub.UniqueError(5)),
+		}, stub.UniqueError(5)},
+
+		{"mkdirAll ensure", new(Params), &BindMountOp{
+			Source: MustAbs("/bin/"),
+			Target: MustAbs("/bin/"),
+			Flags:  BindEnsure,
+		}, []stub.Call{
+			call("mkdirAll", stub.ExpectArgs{"/bin/", os.FileMode(0700)}, nil, stub.UniqueError(4)),
+		}, stub.UniqueError(4), nil, nil},
+
+		{"success ensure", new(Params), &BindMountOp{
+			Source: MustAbs("/bin/"),
+			Target: MustAbs("/usr/bin/"),
+			Flags:  BindEnsure,
+		}, []stub.Call{
+			call("mkdirAll", stub.ExpectArgs{"/bin/", os.FileMode(0700)}, nil, nil),
+			call("evalSymlinks", stub.ExpectArgs{"/bin/"}, "/usr/bin", nil),
+		}, nil, []stub.Call{
+			call("stat", stub.ExpectArgs{"/host/usr/bin"}, isDirFi(true), nil),
+			call("mkdirAll", stub.ExpectArgs{"/sysroot/usr/bin", os.FileMode(0700)}, nil, nil),
+			call("verbosef", stub.ExpectArgs{"mounting %q on %q flags %#x", []any{"/host/usr/bin", "/sysroot/usr/bin", uintptr(0x4005)}}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/usr/bin", "/sysroot/usr/bin", uintptr(0x4005), false}, nil, nil),
+		}, nil},
+
+		{"success device ro", new(Params), &BindMountOp{
+			Source: MustAbs("/dev/null"),
+			Target: MustAbs("/dev/null"),
+			Flags:  BindDevice,
+		}, []stub.Call{
+			call("evalSymlinks", stub.ExpectArgs{"/dev/null"}, "/dev/null", nil),
+		}, nil, []stub.Call{
+			call("stat", stub.ExpectArgs{"/host/dev/null"}, isDirFi(false), nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/null", os.FileMode(0444), os.FileMode(0700)}, nil, nil),
+			call("verbosef", stub.ExpectArgs{"mounting %q flags %#x", []any{"/sysroot/dev/null", uintptr(0x4001)}}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/null", "/sysroot/dev/null", uintptr(0x4001), false}, nil, nil),
+		}, nil},
+
+		{"success device", new(Params), &BindMountOp{
+			Source: MustAbs("/dev/null"),
+			Target: MustAbs("/dev/null"),
+			Flags:  BindWritable | BindDevice,
+		}, []stub.Call{
+			call("evalSymlinks", stub.ExpectArgs{"/dev/null"}, "/dev/null", nil),
+		}, nil, []stub.Call{
+			call("stat", stub.ExpectArgs{"/host/dev/null"}, isDirFi(false), nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/null", os.FileMode(0444), os.FileMode(0700)}, nil, nil),
+			call("verbosef", stub.ExpectArgs{"mounting %q flags %#x", []any{"/sysroot/dev/null", uintptr(0x4000)}}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/null", "/sysroot/dev/null", uintptr(0x4000), false}, nil, nil),
+		}, nil},
+
+		{"evalSymlinks", new(Params), &BindMountOp{
+			Source: MustAbs("/bin/"),
+			Target: MustAbs("/bin/"),
+		}, []stub.Call{
+			call("evalSymlinks", stub.ExpectArgs{"/bin/"}, "/usr/bin", stub.UniqueError(3)),
+		}, stub.UniqueError(3), nil, nil},
+
+		{"stat", new(Params), &BindMountOp{
+			Source: MustAbs("/bin/"),
+			Target: MustAbs("/bin/"),
+		}, []stub.Call{
+			call("evalSymlinks", stub.ExpectArgs{"/bin/"}, "/usr/bin", nil),
+		}, nil, []stub.Call{
+			call("stat", stub.ExpectArgs{"/host/usr/bin"}, isDirFi(true), stub.UniqueError(2)),
+		}, stub.UniqueError(2)},
+
+		{"mkdirAll", new(Params), &BindMountOp{
+			Source: MustAbs("/bin/"),
+			Target: MustAbs("/bin/"),
+		}, []stub.Call{
+			call("evalSymlinks", stub.ExpectArgs{"/bin/"}, "/usr/bin", nil),
+		}, nil, []stub.Call{
+			call("stat", stub.ExpectArgs{"/host/usr/bin"}, isDirFi(true), nil),
+			call("mkdirAll", stub.ExpectArgs{"/sysroot/bin", os.FileMode(0700)}, nil, stub.UniqueError(1)),
+		}, stub.UniqueError(1)},
+
+		{"bindMount", new(Params), &BindMountOp{
+			Source: MustAbs("/bin/"),
+			Target: MustAbs("/bin/"),
+		}, []stub.Call{
+			call("evalSymlinks", stub.ExpectArgs{"/bin/"}, "/usr/bin", nil),
+		}, nil, []stub.Call{
+			call("stat", stub.ExpectArgs{"/host/usr/bin"}, isDirFi(true), nil),
+			call("mkdirAll", stub.ExpectArgs{"/sysroot/bin", os.FileMode(0700)}, nil, nil),
+			call("verbosef", stub.ExpectArgs{"mounting %q on %q flags %#x", []any{"/host/usr/bin", "/sysroot/bin", uintptr(0x4005)}}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/usr/bin", "/sysroot/bin", uintptr(0x4005), false}, nil, stub.UniqueError(0)),
+		}, stub.UniqueError(0)},
+
+		{"success eval equals", new(Params), &BindMountOp{
+			Source: MustAbs("/bin/"),
+			Target: MustAbs("/bin/"),
+		}, []stub.Call{
+			call("evalSymlinks", stub.ExpectArgs{"/bin/"}, "/bin", nil),
+		}, nil, []stub.Call{
+			call("stat", stub.ExpectArgs{"/host/bin"}, isDirFi(true), nil),
+			call("mkdirAll", stub.ExpectArgs{"/sysroot/bin", os.FileMode(0700)}, nil, nil),
+			call("verbosef", stub.ExpectArgs{"mounting %q on %q flags %#x", []any{"/host/bin", "/sysroot/bin", uintptr(0x4005)}}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/bin", "/sysroot/bin", uintptr(0x4005), false}, nil, nil),
+		}, nil},
+
+		{"success", new(Params), &BindMountOp{
+			Source: MustAbs("/bin/"),
+			Target: MustAbs("/bin/"),
+		}, []stub.Call{
+			call("evalSymlinks", stub.ExpectArgs{"/bin/"}, "/usr/bin", nil),
+		}, nil, []stub.Call{
+			call("stat", stub.ExpectArgs{"/host/usr/bin"}, isDirFi(true), nil),
+			call("mkdirAll", stub.ExpectArgs{"/sysroot/bin", os.FileMode(0700)}, nil, nil),
+			call("verbosef", stub.ExpectArgs{"mounting %q on %q flags %#x", []any{"/host/usr/bin", "/sysroot/bin", uintptr(0x4005)}}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/usr/bin", "/sysroot/bin", uintptr(0x4005), false}, nil, nil),
+		}, nil},
+	})
+
+	t.Run("unreachable", func(t *testing.T) {
+		t.Run("nil sourceFinal not optional", func(t *testing.T) {
+			wantErr := OpStateError("bind")
+			if err := new(BindMountOp).apply(nil, nil); !errors.Is(err, wantErr) {
+				t.Errorf("apply: error = %v, want %v", err, wantErr)
+			}
+		})
+	})
+
+	checkOpsValid(t, []opValidTestCase{
+		{"nil", (*BindMountOp)(nil), false},
+		{"zero", new(BindMountOp), false},
+		{"nil source", &BindMountOp{Target: MustAbs("/")}, false},
+		{"nil target", &BindMountOp{Source: MustAbs("/")}, false},
+		{"flag optional ensure", &BindMountOp{Source: MustAbs("/"), Target: MustAbs("/"), Flags: BindOptional | BindEnsure}, false},
+		{"valid", &BindMountOp{Source: MustAbs("/"), Target: MustAbs("/")}, true},
+	})
+
+	checkOpsBuilder(t, []opsBuilderTestCase{
+		{"autoetc", new(Ops).Bind(
+			MustAbs("/etc/"),
+			MustAbs("/etc/.host/048090b6ed8f9ebb10e275ff5d8c0659"),
+			0,
+		), Ops{
+			&BindMountOp{
+				Source: MustAbs("/etc/"),
+				Target: MustAbs("/etc/.host/048090b6ed8f9ebb10e275ff5d8c0659"),
+			},
+		}},
+	})
+
+	checkOpIs(t, []opIsTestCase{
+		{"zero", new(BindMountOp), new(BindMountOp), false},
+
+		{"internal ne", &BindMountOp{
+			Source: MustAbs("/etc/"),
+			Target: MustAbs("/etc/.host/048090b6ed8f9ebb10e275ff5d8c0659"),
+		}, &BindMountOp{
+			Source:      MustAbs("/etc/"),
+			Target:      MustAbs("/etc/.host/048090b6ed8f9ebb10e275ff5d8c0659"),
+			sourceFinal: MustAbs("/etc/"),
+		}, true},
+
+		{"flags differs", &BindMountOp{
+			Source: MustAbs("/etc/"),
+			Target: MustAbs("/etc/.host/048090b6ed8f9ebb10e275ff5d8c0659"),
+		}, &BindMountOp{
+			Source: MustAbs("/etc/"),
+			Target: MustAbs("/etc/.host/048090b6ed8f9ebb10e275ff5d8c0659"),
+			Flags:  BindOptional,
+		}, false},
+
+		{"source differs", &BindMountOp{
+			Source: MustAbs("/.hakurei/etc/"),
+			Target: MustAbs("/etc/.host/048090b6ed8f9ebb10e275ff5d8c0659"),
+		}, &BindMountOp{
+			Source: MustAbs("/etc/"),
+			Target: MustAbs("/etc/.host/048090b6ed8f9ebb10e275ff5d8c0659"),
+		}, false},
+
+		{"target differs", &BindMountOp{
+			Source: MustAbs("/etc/"),
+			Target: MustAbs("/etc/.host/048090b6ed8f9ebb10e275ff5d8c0659"),
+		}, &BindMountOp{
+			Source: MustAbs("/etc/"),
+			Target: MustAbs("/etc/"),
+		}, false},
+
+		{"equals", &BindMountOp{
+			Source: MustAbs("/etc/"),
+			Target: MustAbs("/etc/.host/048090b6ed8f9ebb10e275ff5d8c0659"),
+		}, &BindMountOp{
+			Source: MustAbs("/etc/"),
+			Target: MustAbs("/etc/.host/048090b6ed8f9ebb10e275ff5d8c0659"),
+		}, true},
+	})
+
+	checkOpMeta(t, []opMetaTestCase{
+		{"invalid", new(BindMountOp), "mounting", "<invalid>"},
+
+		{"autoetc", &BindMountOp{
+			Source: MustAbs("/etc/"),
+			Target: MustAbs("/etc/.host/048090b6ed8f9ebb10e275ff5d8c0659"),
+		}, "mounting", `"/etc/" on "/etc/.host/048090b6ed8f9ebb10e275ff5d8c0659" flags 0x0`},
+
+		{"hostdev", &BindMountOp{
+			Source: MustAbs("/dev/"),
+			Target: MustAbs("/dev/"),
+			Flags:  BindWritable | BindDevice,
+		}, "mounting", `"/dev/" flags 0x6`},
+	})
+}

container/initdev.go

@@ -0,0 +1,138 @@
+package container
+
+import (
+	"encoding/gob"
+	"fmt"
+	"path"
+	. "syscall"
+)
+
+func init() { gob.Register(new(MountDevOp)) }
+
+// Dev appends an [Op] that mounts a subset of host /dev.
+func (f *Ops) Dev(target *Absolute, mqueue bool) *Ops {
+	*f = append(*f, &MountDevOp{target, mqueue, false})
+	return f
+}
+
+// DevWritable appends an [Op] that mounts a writable subset of host /dev.
+// There is usually no good reason to write to /dev, so this should always be followed by a [RemountOp].
+func (f *Ops) DevWritable(target *Absolute, mqueue bool) *Ops {
+	*f = append(*f, &MountDevOp{target, mqueue, true})
+	return f
+}
+
+// MountDevOp mounts a subset of host /dev on container path Target.
+// If Mqueue is true, a private instance of [FstypeMqueue] is mounted.
+// If Write is true, the resulting mount point is left writable.
+type MountDevOp struct {
+	Target *Absolute
+	Mqueue bool
+	Write  bool
+}
+
+func (d *MountDevOp) Valid() bool                                { return d != nil && d.Target != nil }
+func (d *MountDevOp) early(*setupState, syscallDispatcher) error { return nil }
+func (d *MountDevOp) apply(state *setupState, k syscallDispatcher) error {
+	target := toSysroot(d.Target.String())
+
+	if err := k.mountTmpfs(SourceTmpfsDevtmpfs, target, MS_NOSUID|MS_NODEV, 0, state.ParentPerm); err != nil {
+		return err
+	}
+
+	for _, name := range []string{"null", "zero", "full", "random", "urandom", "tty"} {
+		targetPath := path.Join(target, name)
+		if err := k.ensureFile(targetPath, 0444, state.ParentPerm); err != nil {
+			return err
+		}
+		if err := k.bindMount(
+			toHost(FHSDev+name),
+			targetPath,
+			0,
+		); err != nil {
+			return err
+		}
+	}
+	for i, name := range []string{"stdin", "stdout", "stderr"} {
+		if err := k.symlink(
+			FHSProc+"self/fd/"+string(rune(i+'0')),
+			path.Join(target, name),
+		); err != nil {
+			return err
+		}
+	}
+	for _, pair := range [][2]string{
+		{FHSProc + "self/fd", "fd"},
+		{FHSProc + "kcore", "core"},
+		{"pts/ptmx", "ptmx"},
+	} {
+		if err := k.symlink(pair[0], path.Join(target, pair[1])); err != nil {
+			return err
+		}
+	}
+
+	devShmPath := path.Join(target, "shm")
+	devPtsPath := path.Join(target, "pts")
+	for _, name := range []string{devShmPath, devPtsPath} {
+		if err := k.mkdir(name, state.ParentPerm); err != nil {
+			return err
+		}
+	}
+
+	if err := k.mount(SourceDevpts, devPtsPath, FstypeDevpts, MS_NOSUID|MS_NOEXEC,
+		"newinstance,ptmxmode=0666,mode=620"); err != nil {
+		return err
+	}
+
+	if state.RetainSession {
+		if k.isatty(Stdout) {
+			consolePath := path.Join(target, "console")
+			if err := k.ensureFile(consolePath, 0444, state.ParentPerm); err != nil {
+				return err
+			}
+			if name, err := k.readlink(hostProc.stdout()); err != nil {
+				return err
+			} else if err = k.bindMount(
+				toHost(name),
+				consolePath,
+				0,
+			); err != nil {
+				return err
+			}
+		}
+	}
+
+	if d.Mqueue {
+		mqueueTarget := path.Join(target, "mqueue")
+		if err := k.mkdir(mqueueTarget, state.ParentPerm); err != nil {
+			return err
+		}
+		if err := k.mount(SourceMqueue, mqueueTarget, FstypeMqueue, MS_NOSUID|MS_NOEXEC|MS_NODEV, zeroString); err != nil {
+			return err
+		}
+	}
+
+	if d.Write {
+		return nil
+	}
+
+	if err := k.remount(target, MS_RDONLY); err != nil {
+		return err
+	}
+	return k.mountTmpfs(SourceTmpfs, devShmPath, MS_NOSUID|MS_NODEV, 0, 01777)
+}
+
+func (d *MountDevOp) Is(op Op) bool {
+	vd, ok := op.(*MountDevOp)
+	return ok && d.Valid() && vd.Valid() &&
+		d.Target.Is(vd.Target) &&
+		d.Mqueue == vd.Mqueue &&
+		d.Write == vd.Write
+}
+func (*MountDevOp) prefix() (string, bool) { return "mounting", true }
+func (d *MountDevOp) String() string {
+	if d.Mqueue {
+		return fmt.Sprintf("dev on %q with mqueue", d.Target)
+	}
+	return fmt.Sprintf("dev on %q", d.Target)
+}

container/initdev_test.go

@@ -0,0 +1,825 @@
+package container
+
+import (
+	"os"
+	"testing"
+
+	"hakurei.app/container/stub"
+)
+
+func TestMountDevOp(t *testing.T) {
+	checkOpBehaviour(t, []opBehaviourTestCase{
+		{"mountTmpfs", &Params{ParentPerm: 0750, RetainSession: true}, &MountDevOp{
+			Target: MustAbs("/dev/"),
+			Mqueue: true,
+		}, nil, nil, []stub.Call{
+			call("mountTmpfs", stub.ExpectArgs{"devtmpfs", "/sysroot/dev", uintptr(0x6), 0, os.FileMode(0750)}, nil, stub.UniqueError(27)),
+		}, stub.UniqueError(27)},
+
+		{"ensureFile null", &Params{ParentPerm: 0750, RetainSession: true}, &MountDevOp{
+			Target: MustAbs("/dev/"),
+			Mqueue: true,
+		}, nil, nil, []stub.Call{
+			call("mountTmpfs", stub.ExpectArgs{"devtmpfs", "/sysroot/dev", uintptr(0x6), 0, os.FileMode(0750)}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/null", os.FileMode(0444), os.FileMode(0750)}, nil, stub.UniqueError(26)),
+		}, stub.UniqueError(26)},
+
+		{"bindMount null", &Params{ParentPerm: 0750, RetainSession: true}, &MountDevOp{
+			Target: MustAbs("/dev/"),
+			Mqueue: true,
+		}, nil, nil, []stub.Call{
+			call("mountTmpfs", stub.ExpectArgs{"devtmpfs", "/sysroot/dev", uintptr(0x6), 0, os.FileMode(0750)}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/null", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/null", "/sysroot/dev/null", uintptr(0), true}, nil, stub.UniqueError(25)),
+		}, stub.UniqueError(25)},
+
+		{"ensureFile zero", &Params{ParentPerm: 0750, RetainSession: true}, &MountDevOp{
+			Target: MustAbs("/dev/"),
+			Mqueue: true,
+		}, nil, nil, []stub.Call{
+			call("mountTmpfs", stub.ExpectArgs{"devtmpfs", "/sysroot/dev", uintptr(0x6), 0, os.FileMode(0750)}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/null", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/null", "/sysroot/dev/null", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/zero", os.FileMode(0444), os.FileMode(0750)}, nil, stub.UniqueError(24)),
+		}, stub.UniqueError(24)},
+
+		{"bindMount zero", &Params{ParentPerm: 0750, RetainSession: true}, &MountDevOp{
+			Target: MustAbs("/dev/"),
+			Mqueue: true,
+		}, nil, nil, []stub.Call{
+			call("mountTmpfs", stub.ExpectArgs{"devtmpfs", "/sysroot/dev", uintptr(0x6), 0, os.FileMode(0750)}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/null", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/null", "/sysroot/dev/null", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/zero", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/zero", "/sysroot/dev/zero", uintptr(0), true}, nil, stub.UniqueError(23)),
+		}, stub.UniqueError(23)},
+
+		{"ensureFile full", &Params{ParentPerm: 0750, RetainSession: true}, &MountDevOp{
+			Target: MustAbs("/dev/"),
+			Mqueue: true,
+		}, nil, nil, []stub.Call{
+			call("mountTmpfs", stub.ExpectArgs{"devtmpfs", "/sysroot/dev", uintptr(0x6), 0, os.FileMode(0750)}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/null", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/null", "/sysroot/dev/null", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/zero", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/zero", "/sysroot/dev/zero", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/full", os.FileMode(0444), os.FileMode(0750)}, nil, stub.UniqueError(22)),
+		}, stub.UniqueError(22)},
+
+		{"bindMount full", &Params{ParentPerm: 0750, RetainSession: true}, &MountDevOp{
+			Target: MustAbs("/dev/"),
+			Mqueue: true,
+		}, nil, nil, []stub.Call{
+			call("mountTmpfs", stub.ExpectArgs{"devtmpfs", "/sysroot/dev", uintptr(0x6), 0, os.FileMode(0750)}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/null", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/null", "/sysroot/dev/null", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/zero", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/zero", "/sysroot/dev/zero", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/full", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/full", "/sysroot/dev/full", uintptr(0), true}, nil, stub.UniqueError(21)),
+		}, stub.UniqueError(21)},
+
+		{"ensureFile random", &Params{ParentPerm: 0750, RetainSession: true}, &MountDevOp{
+			Target: MustAbs("/dev/"),
+			Mqueue: true,
+		}, nil, nil, []stub.Call{
+			call("mountTmpfs", stub.ExpectArgs{"devtmpfs", "/sysroot/dev", uintptr(0x6), 0, os.FileMode(0750)}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/null", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/null", "/sysroot/dev/null", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/zero", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/zero", "/sysroot/dev/zero", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/full", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/full", "/sysroot/dev/full", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/random", os.FileMode(0444), os.FileMode(0750)}, nil, stub.UniqueError(20)),
+		}, stub.UniqueError(20)},
+
+		{"bindMount random", &Params{ParentPerm: 0750, RetainSession: true}, &MountDevOp{
+			Target: MustAbs("/dev/"),
+			Mqueue: true,
+		}, nil, nil, []stub.Call{
+			call("mountTmpfs", stub.ExpectArgs{"devtmpfs", "/sysroot/dev", uintptr(0x6), 0, os.FileMode(0750)}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/null", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/null", "/sysroot/dev/null", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/zero", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/zero", "/sysroot/dev/zero", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/full", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/full", "/sysroot/dev/full", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/random", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/random", "/sysroot/dev/random", uintptr(0), true}, nil, stub.UniqueError(19)),
+		}, stub.UniqueError(19)},
+
+		{"ensureFile urandom", &Params{ParentPerm: 0750, RetainSession: true}, &MountDevOp{
+			Target: MustAbs("/dev/"),
+			Mqueue: true,
+		}, nil, nil, []stub.Call{
+			call("mountTmpfs", stub.ExpectArgs{"devtmpfs", "/sysroot/dev", uintptr(0x6), 0, os.FileMode(0750)}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/null", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/null", "/sysroot/dev/null", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/zero", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/zero", "/sysroot/dev/zero", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/full", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/full", "/sysroot/dev/full", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/random", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/random", "/sysroot/dev/random", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/urandom", os.FileMode(0444), os.FileMode(0750)}, nil, stub.UniqueError(18)),
+		}, stub.UniqueError(18)},
+
+		{"bindMount urandom", &Params{ParentPerm: 0750, RetainSession: true}, &MountDevOp{
+			Target: MustAbs("/dev/"),
+			Mqueue: true,
+		}, nil, nil, []stub.Call{
+			call("mountTmpfs", stub.ExpectArgs{"devtmpfs", "/sysroot/dev", uintptr(0x6), 0, os.FileMode(0750)}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/null", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/null", "/sysroot/dev/null", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/zero", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/zero", "/sysroot/dev/zero", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/full", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/full", "/sysroot/dev/full", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/random", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/random", "/sysroot/dev/random", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/urandom", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/urandom", "/sysroot/dev/urandom", uintptr(0), true}, nil, stub.UniqueError(17)),
+		}, stub.UniqueError(17)},
+
+		{"ensureFile tty", &Params{ParentPerm: 0750, RetainSession: true}, &MountDevOp{
+			Target: MustAbs("/dev/"),
+			Mqueue: true,
+		}, nil, nil, []stub.Call{
+			call("mountTmpfs", stub.ExpectArgs{"devtmpfs", "/sysroot/dev", uintptr(0x6), 0, os.FileMode(0750)}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/null", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/null", "/sysroot/dev/null", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/zero", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/zero", "/sysroot/dev/zero", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/full", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/full", "/sysroot/dev/full", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/random", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/random", "/sysroot/dev/random", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/urandom", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/urandom", "/sysroot/dev/urandom", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/tty", os.FileMode(0444), os.FileMode(0750)}, nil, stub.UniqueError(16)),
+		}, stub.UniqueError(16)},
+
+		{"bindMount tty", &Params{ParentPerm: 0750, RetainSession: true}, &MountDevOp{
+			Target: MustAbs("/dev/"),
+			Mqueue: true,
+		}, nil, nil, []stub.Call{
+			call("mountTmpfs", stub.ExpectArgs{"devtmpfs", "/sysroot/dev", uintptr(0x6), 0, os.FileMode(0750)}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/null", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/null", "/sysroot/dev/null", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/zero", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/zero", "/sysroot/dev/zero", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/full", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/full", "/sysroot/dev/full", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/random", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/random", "/sysroot/dev/random", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/urandom", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/urandom", "/sysroot/dev/urandom", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/tty", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/tty", "/sysroot/dev/tty", uintptr(0), true}, nil, stub.UniqueError(15)),
+		}, stub.UniqueError(15)},
+
+		{"symlink stdin", &Params{ParentPerm: 0750, RetainSession: true}, &MountDevOp{
+			Target: MustAbs("/dev/"),
+			Mqueue: true,
+		}, nil, nil, []stub.Call{
+			call("mountTmpfs", stub.ExpectArgs{"devtmpfs", "/sysroot/dev", uintptr(0x6), 0, os.FileMode(0750)}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/null", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/null", "/sysroot/dev/null", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/zero", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/zero", "/sysroot/dev/zero", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/full", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/full", "/sysroot/dev/full", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/random", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/random", "/sysroot/dev/random", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/urandom", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/urandom", "/sysroot/dev/urandom", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/tty", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/tty", "/sysroot/dev/tty", uintptr(0), true}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/0", "/sysroot/dev/stdin"}, nil, stub.UniqueError(14)),
+		}, stub.UniqueError(14)},
+
+		{"symlink stdout", &Params{ParentPerm: 0750, RetainSession: true}, &MountDevOp{
+			Target: MustAbs("/dev/"),
+			Mqueue: true,
+		}, nil, nil, []stub.Call{
+			call("mountTmpfs", stub.ExpectArgs{"devtmpfs", "/sysroot/dev", uintptr(0x6), 0, os.FileMode(0750)}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/null", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/null", "/sysroot/dev/null", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/zero", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/zero", "/sysroot/dev/zero", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/full", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/full", "/sysroot/dev/full", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/random", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/random", "/sysroot/dev/random", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/urandom", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/urandom", "/sysroot/dev/urandom", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/tty", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/tty", "/sysroot/dev/tty", uintptr(0), true}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/0", "/sysroot/dev/stdin"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/1", "/sysroot/dev/stdout"}, nil, stub.UniqueError(13)),
+		}, stub.UniqueError(13)},
+
+		{"symlink stderr", &Params{ParentPerm: 0750, RetainSession: true}, &MountDevOp{
+			Target: MustAbs("/dev/"),
+			Mqueue: true,
+		}, nil, nil, []stub.Call{
+			call("mountTmpfs", stub.ExpectArgs{"devtmpfs", "/sysroot/dev", uintptr(0x6), 0, os.FileMode(0750)}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/null", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/null", "/sysroot/dev/null", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/zero", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/zero", "/sysroot/dev/zero", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/full", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/full", "/sysroot/dev/full", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/random", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/random", "/sysroot/dev/random", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/urandom", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/urandom", "/sysroot/dev/urandom", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/tty", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/tty", "/sysroot/dev/tty", uintptr(0), true}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/0", "/sysroot/dev/stdin"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/1", "/sysroot/dev/stdout"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/2", "/sysroot/dev/stderr"}, nil, stub.UniqueError(12)),
+		}, stub.UniqueError(12)},
+
+		{"symlink fd", &Params{ParentPerm: 0750, RetainSession: true}, &MountDevOp{
+			Target: MustAbs("/dev/"),
+			Mqueue: true,
+		}, nil, nil, []stub.Call{
+			call("mountTmpfs", stub.ExpectArgs{"devtmpfs", "/sysroot/dev", uintptr(0x6), 0, os.FileMode(0750)}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/null", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/null", "/sysroot/dev/null", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/zero", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/zero", "/sysroot/dev/zero", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/full", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/full", "/sysroot/dev/full", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/random", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/random", "/sysroot/dev/random", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/urandom", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/urandom", "/sysroot/dev/urandom", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/tty", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/tty", "/sysroot/dev/tty", uintptr(0), true}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/0", "/sysroot/dev/stdin"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/1", "/sysroot/dev/stdout"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/2", "/sysroot/dev/stderr"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd", "/sysroot/dev/fd"}, nil, stub.UniqueError(11)),
+		}, stub.UniqueError(11)},
+
+		{"symlink kcore", &Params{ParentPerm: 0750, RetainSession: true}, &MountDevOp{
+			Target: MustAbs("/dev/"),
+			Mqueue: true,
+		}, nil, nil, []stub.Call{
+			call("mountTmpfs", stub.ExpectArgs{"devtmpfs", "/sysroot/dev", uintptr(0x6), 0, os.FileMode(0750)}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/null", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/null", "/sysroot/dev/null", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/zero", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/zero", "/sysroot/dev/zero", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/full", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/full", "/sysroot/dev/full", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/random", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/random", "/sysroot/dev/random", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/urandom", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/urandom", "/sysroot/dev/urandom", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/tty", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/tty", "/sysroot/dev/tty", uintptr(0), true}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/0", "/sysroot/dev/stdin"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/1", "/sysroot/dev/stdout"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/2", "/sysroot/dev/stderr"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd", "/sysroot/dev/fd"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/kcore", "/sysroot/dev/core"}, nil, stub.UniqueError(10)),
+		}, stub.UniqueError(10)},
+
+		{"symlink ptmx", &Params{ParentPerm: 0750, RetainSession: true}, &MountDevOp{
+			Target: MustAbs("/dev/"),
+			Mqueue: true,
+		}, nil, nil, []stub.Call{
+			call("mountTmpfs", stub.ExpectArgs{"devtmpfs", "/sysroot/dev", uintptr(0x6), 0, os.FileMode(0750)}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/null", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/null", "/sysroot/dev/null", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/zero", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/zero", "/sysroot/dev/zero", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/full", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/full", "/sysroot/dev/full", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/random", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/random", "/sysroot/dev/random", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/urandom", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/urandom", "/sysroot/dev/urandom", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/tty", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/tty", "/sysroot/dev/tty", uintptr(0), true}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/0", "/sysroot/dev/stdin"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/1", "/sysroot/dev/stdout"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/2", "/sysroot/dev/stderr"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd", "/sysroot/dev/fd"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/kcore", "/sysroot/dev/core"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"pts/ptmx", "/sysroot/dev/ptmx"}, nil, stub.UniqueError(9)),
+		}, stub.UniqueError(9)},
+
+		{"mkdir shm", &Params{ParentPerm: 0750, RetainSession: true}, &MountDevOp{
+			Target: MustAbs("/dev/"),
+			Mqueue: true,
+		}, nil, nil, []stub.Call{
+			call("mountTmpfs", stub.ExpectArgs{"devtmpfs", "/sysroot/dev", uintptr(0x6), 0, os.FileMode(0750)}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/null", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/null", "/sysroot/dev/null", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/zero", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/zero", "/sysroot/dev/zero", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/full", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/full", "/sysroot/dev/full", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/random", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/random", "/sysroot/dev/random", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/urandom", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/urandom", "/sysroot/dev/urandom", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/tty", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/tty", "/sysroot/dev/tty", uintptr(0), true}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/0", "/sysroot/dev/stdin"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/1", "/sysroot/dev/stdout"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/2", "/sysroot/dev/stderr"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd", "/sysroot/dev/fd"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/kcore", "/sysroot/dev/core"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"pts/ptmx", "/sysroot/dev/ptmx"}, nil, nil),
+			call("mkdir", stub.ExpectArgs{"/sysroot/dev/shm", os.FileMode(0750)}, nil, stub.UniqueError(8)),
+		}, stub.UniqueError(8)},
+
+		{"mkdir devpts", &Params{ParentPerm: 0750, RetainSession: true}, &MountDevOp{
+			Target: MustAbs("/dev/"),
+			Mqueue: true,
+		}, nil, nil, []stub.Call{
+			call("mountTmpfs", stub.ExpectArgs{"devtmpfs", "/sysroot/dev", uintptr(0x6), 0, os.FileMode(0750)}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/null", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/null", "/sysroot/dev/null", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/zero", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/zero", "/sysroot/dev/zero", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/full", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/full", "/sysroot/dev/full", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/random", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/random", "/sysroot/dev/random", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/urandom", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/urandom", "/sysroot/dev/urandom", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/tty", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/tty", "/sysroot/dev/tty", uintptr(0), true}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/0", "/sysroot/dev/stdin"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/1", "/sysroot/dev/stdout"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/2", "/sysroot/dev/stderr"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd", "/sysroot/dev/fd"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/kcore", "/sysroot/dev/core"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"pts/ptmx", "/sysroot/dev/ptmx"}, nil, nil),
+			call("mkdir", stub.ExpectArgs{"/sysroot/dev/shm", os.FileMode(0750)}, nil, nil),
+			call("mkdir", stub.ExpectArgs{"/sysroot/dev/pts", os.FileMode(0750)}, nil, stub.UniqueError(7)),
+		}, stub.UniqueError(7)},
+
+		{"mount devpts", &Params{ParentPerm: 0750, RetainSession: true}, &MountDevOp{
+			Target: MustAbs("/dev/"),
+			Mqueue: true,
+		}, nil, nil, []stub.Call{
+			call("mountTmpfs", stub.ExpectArgs{"devtmpfs", "/sysroot/dev", uintptr(0x6), 0, os.FileMode(0750)}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/null", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/null", "/sysroot/dev/null", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/zero", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/zero", "/sysroot/dev/zero", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/full", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/full", "/sysroot/dev/full", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/random", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/random", "/sysroot/dev/random", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/urandom", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/urandom", "/sysroot/dev/urandom", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/tty", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/tty", "/sysroot/dev/tty", uintptr(0), true}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/0", "/sysroot/dev/stdin"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/1", "/sysroot/dev/stdout"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/2", "/sysroot/dev/stderr"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd", "/sysroot/dev/fd"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/kcore", "/sysroot/dev/core"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"pts/ptmx", "/sysroot/dev/ptmx"}, nil, nil),
+			call("mkdir", stub.ExpectArgs{"/sysroot/dev/shm", os.FileMode(0750)}, nil, nil),
+			call("mkdir", stub.ExpectArgs{"/sysroot/dev/pts", os.FileMode(0750)}, nil, nil),
+			call("mount", stub.ExpectArgs{"devpts", "/sysroot/dev/pts", "devpts", uintptr(0xa), "newinstance,ptmxmode=0666,mode=620"}, nil, stub.UniqueError(6)),
+		}, stub.UniqueError(6)},
+
+		{"ensureFile stdout", &Params{ParentPerm: 0750, RetainSession: true}, &MountDevOp{
+			Target: MustAbs("/dev/"),
+			Mqueue: true,
+		}, nil, nil, []stub.Call{
+			call("mountTmpfs", stub.ExpectArgs{"devtmpfs", "/sysroot/dev", uintptr(0x6), 0, os.FileMode(0750)}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/null", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/null", "/sysroot/dev/null", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/zero", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/zero", "/sysroot/dev/zero", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/full", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/full", "/sysroot/dev/full", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/random", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/random", "/sysroot/dev/random", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/urandom", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/urandom", "/sysroot/dev/urandom", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/tty", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/tty", "/sysroot/dev/tty", uintptr(0), true}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/0", "/sysroot/dev/stdin"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/1", "/sysroot/dev/stdout"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/2", "/sysroot/dev/stderr"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd", "/sysroot/dev/fd"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/kcore", "/sysroot/dev/core"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"pts/ptmx", "/sysroot/dev/ptmx"}, nil, nil),
+			call("mkdir", stub.ExpectArgs{"/sysroot/dev/shm", os.FileMode(0750)}, nil, nil),
+			call("mkdir", stub.ExpectArgs{"/sysroot/dev/pts", os.FileMode(0750)}, nil, nil),
+			call("mount", stub.ExpectArgs{"devpts", "/sysroot/dev/pts", "devpts", uintptr(0xa), "newinstance,ptmxmode=0666,mode=620"}, nil, nil),
+			call("isatty", stub.ExpectArgs{1}, true, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/console", os.FileMode(0444), os.FileMode(0750)}, nil, stub.UniqueError(5)),
+		}, stub.UniqueError(5)},
+
+		{"readlink stdout", &Params{ParentPerm: 0750, RetainSession: true}, &MountDevOp{
+			Target: MustAbs("/dev/"),
+			Mqueue: true,
+		}, nil, nil, []stub.Call{
+			call("mountTmpfs", stub.ExpectArgs{"devtmpfs", "/sysroot/dev", uintptr(0x6), 0, os.FileMode(0750)}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/null", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/null", "/sysroot/dev/null", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/zero", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/zero", "/sysroot/dev/zero", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/full", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/full", "/sysroot/dev/full", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/random", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/random", "/sysroot/dev/random", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/urandom", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/urandom", "/sysroot/dev/urandom", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/tty", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/tty", "/sysroot/dev/tty", uintptr(0), true}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/0", "/sysroot/dev/stdin"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/1", "/sysroot/dev/stdout"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/2", "/sysroot/dev/stderr"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd", "/sysroot/dev/fd"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/kcore", "/sysroot/dev/core"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"pts/ptmx", "/sysroot/dev/ptmx"}, nil, nil),
+			call("mkdir", stub.ExpectArgs{"/sysroot/dev/shm", os.FileMode(0750)}, nil, nil),
+			call("mkdir", stub.ExpectArgs{"/sysroot/dev/pts", os.FileMode(0750)}, nil, nil),
+			call("mount", stub.ExpectArgs{"devpts", "/sysroot/dev/pts", "devpts", uintptr(0xa), "newinstance,ptmxmode=0666,mode=620"}, nil, nil),
+			call("isatty", stub.ExpectArgs{1}, true, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/console", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/1"}, "", stub.UniqueError(4)),
+		}, stub.UniqueError(4)},
+
+		{"bindMount stdout", &Params{ParentPerm: 0750, RetainSession: true}, &MountDevOp{
+			Target: MustAbs("/dev/"),
+			Mqueue: true,
+		}, nil, nil, []stub.Call{
+			call("mountTmpfs", stub.ExpectArgs{"devtmpfs", "/sysroot/dev", uintptr(0x6), 0, os.FileMode(0750)}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/null", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/null", "/sysroot/dev/null", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/zero", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/zero", "/sysroot/dev/zero", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/full", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/full", "/sysroot/dev/full", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/random", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/random", "/sysroot/dev/random", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/urandom", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/urandom", "/sysroot/dev/urandom", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/tty", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/tty", "/sysroot/dev/tty", uintptr(0), true}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/0", "/sysroot/dev/stdin"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/1", "/sysroot/dev/stdout"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/2", "/sysroot/dev/stderr"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd", "/sysroot/dev/fd"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/kcore", "/sysroot/dev/core"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"pts/ptmx", "/sysroot/dev/ptmx"}, nil, nil),
+			call("mkdir", stub.ExpectArgs{"/sysroot/dev/shm", os.FileMode(0750)}, nil, nil),
+			call("mkdir", stub.ExpectArgs{"/sysroot/dev/pts", os.FileMode(0750)}, nil, nil),
+			call("mount", stub.ExpectArgs{"devpts", "/sysroot/dev/pts", "devpts", uintptr(0xa), "newinstance,ptmxmode=0666,mode=620"}, nil, nil),
+			call("isatty", stub.ExpectArgs{1}, true, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/console", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/1"}, "/dev/pts/2", nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/pts/2", "/sysroot/dev/console", uintptr(0), false}, nil, stub.UniqueError(3)),
+		}, stub.UniqueError(3)},
+
+		{"mkdir mqueue", &Params{ParentPerm: 0750, RetainSession: true}, &MountDevOp{
+			Target: MustAbs("/dev/"),
+			Mqueue: true,
+		}, nil, nil, []stub.Call{
+			call("mountTmpfs", stub.ExpectArgs{"devtmpfs", "/sysroot/dev", uintptr(0x6), 0, os.FileMode(0750)}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/null", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/null", "/sysroot/dev/null", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/zero", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/zero", "/sysroot/dev/zero", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/full", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/full", "/sysroot/dev/full", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/random", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/random", "/sysroot/dev/random", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/urandom", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/urandom", "/sysroot/dev/urandom", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/tty", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/tty", "/sysroot/dev/tty", uintptr(0), true}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/0", "/sysroot/dev/stdin"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/1", "/sysroot/dev/stdout"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/2", "/sysroot/dev/stderr"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd", "/sysroot/dev/fd"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/kcore", "/sysroot/dev/core"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"pts/ptmx", "/sysroot/dev/ptmx"}, nil, nil),
+			call("mkdir", stub.ExpectArgs{"/sysroot/dev/shm", os.FileMode(0750)}, nil, nil),
+			call("mkdir", stub.ExpectArgs{"/sysroot/dev/pts", os.FileMode(0750)}, nil, nil),
+			call("mount", stub.ExpectArgs{"devpts", "/sysroot/dev/pts", "devpts", uintptr(0xa), "newinstance,ptmxmode=0666,mode=620"}, nil, nil),
+			call("isatty", stub.ExpectArgs{1}, true, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/console", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/1"}, "/dev/pts/2", nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/pts/2", "/sysroot/dev/console", uintptr(0), false}, nil, nil),
+			call("mkdir", stub.ExpectArgs{"/sysroot/dev/mqueue", os.FileMode(0750)}, nil, stub.UniqueError(2)),
+		}, stub.UniqueError(2)},
+
+		{"mount mqueue", &Params{ParentPerm: 0750, RetainSession: true}, &MountDevOp{
+			Target: MustAbs("/dev/"),
+			Mqueue: true,
+		}, nil, nil, []stub.Call{
+			call("mountTmpfs", stub.ExpectArgs{"devtmpfs", "/sysroot/dev", uintptr(0x6), 0, os.FileMode(0750)}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/null", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/null", "/sysroot/dev/null", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/zero", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/zero", "/sysroot/dev/zero", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/full", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/full", "/sysroot/dev/full", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/random", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/random", "/sysroot/dev/random", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/urandom", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/urandom", "/sysroot/dev/urandom", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/tty", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/tty", "/sysroot/dev/tty", uintptr(0), true}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/0", "/sysroot/dev/stdin"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/1", "/sysroot/dev/stdout"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/2", "/sysroot/dev/stderr"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd", "/sysroot/dev/fd"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/kcore", "/sysroot/dev/core"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"pts/ptmx", "/sysroot/dev/ptmx"}, nil, nil),
+			call("mkdir", stub.ExpectArgs{"/sysroot/dev/shm", os.FileMode(0750)}, nil, nil),
+			call("mkdir", stub.ExpectArgs{"/sysroot/dev/pts", os.FileMode(0750)}, nil, nil),
+			call("mount", stub.ExpectArgs{"devpts", "/sysroot/dev/pts", "devpts", uintptr(0xa), "newinstance,ptmxmode=0666,mode=620"}, nil, nil),
+			call("isatty", stub.ExpectArgs{1}, true, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/console", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/1"}, "/dev/pts/2", nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/pts/2", "/sysroot/dev/console", uintptr(0), false}, nil, nil),
+			call("mkdir", stub.ExpectArgs{"/sysroot/dev/mqueue", os.FileMode(0750)}, nil, nil),
+			call("mount", stub.ExpectArgs{"mqueue", "/sysroot/dev/mqueue", "mqueue", uintptr(0xe), ""}, nil, stub.UniqueError(1)),
+		}, stub.UniqueError(1)},
+
+		{"success no session", &Params{ParentPerm: 0755}, &MountDevOp{
+			Target: MustAbs("/dev/"),
+			Mqueue: true,
+			Write:  true,
+		}, nil, nil, []stub.Call{
+			call("mountTmpfs", stub.ExpectArgs{"devtmpfs", "/sysroot/dev", uintptr(0x6), 0, os.FileMode(0755)}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/null", os.FileMode(0444), os.FileMode(0755)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/null", "/sysroot/dev/null", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/zero", os.FileMode(0444), os.FileMode(0755)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/zero", "/sysroot/dev/zero", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/full", os.FileMode(0444), os.FileMode(0755)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/full", "/sysroot/dev/full", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/random", os.FileMode(0444), os.FileMode(0755)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/random", "/sysroot/dev/random", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/urandom", os.FileMode(0444), os.FileMode(0755)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/urandom", "/sysroot/dev/urandom", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/tty", os.FileMode(0444), os.FileMode(0755)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/tty", "/sysroot/dev/tty", uintptr(0), true}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/0", "/sysroot/dev/stdin"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/1", "/sysroot/dev/stdout"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/2", "/sysroot/dev/stderr"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd", "/sysroot/dev/fd"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/kcore", "/sysroot/dev/core"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"pts/ptmx", "/sysroot/dev/ptmx"}, nil, nil),
+			call("mkdir", stub.ExpectArgs{"/sysroot/dev/shm", os.FileMode(0755)}, nil, nil),
+			call("mkdir", stub.ExpectArgs{"/sysroot/dev/pts", os.FileMode(0755)}, nil, nil),
+			call("mount", stub.ExpectArgs{"devpts", "/sysroot/dev/pts", "devpts", uintptr(0xa), "newinstance,ptmxmode=0666,mode=620"}, nil, nil),
+			call("mkdir", stub.ExpectArgs{"/sysroot/dev/mqueue", os.FileMode(0755)}, nil, nil),
+			call("mount", stub.ExpectArgs{"mqueue", "/sysroot/dev/mqueue", "mqueue", uintptr(0xe), ""}, nil, nil),
+		}, nil},
+
+		{"success no tty", &Params{ParentPerm: 0750, RetainSession: true}, &MountDevOp{
+			Target: MustAbs("/dev/"),
+			Mqueue: true,
+			Write:  true,
+		}, nil, nil, []stub.Call{
+			call("mountTmpfs", stub.ExpectArgs{"devtmpfs", "/sysroot/dev", uintptr(0x6), 0, os.FileMode(0750)}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/null", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/null", "/sysroot/dev/null", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/zero", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/zero", "/sysroot/dev/zero", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/full", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/full", "/sysroot/dev/full", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/random", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/random", "/sysroot/dev/random", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/urandom", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/urandom", "/sysroot/dev/urandom", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/tty", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/tty", "/sysroot/dev/tty", uintptr(0), true}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/0", "/sysroot/dev/stdin"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/1", "/sysroot/dev/stdout"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/2", "/sysroot/dev/stderr"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd", "/sysroot/dev/fd"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/kcore", "/sysroot/dev/core"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"pts/ptmx", "/sysroot/dev/ptmx"}, nil, nil),
+			call("mkdir", stub.ExpectArgs{"/sysroot/dev/shm", os.FileMode(0750)}, nil, nil),
+			call("mkdir", stub.ExpectArgs{"/sysroot/dev/pts", os.FileMode(0750)}, nil, nil),
+			call("mount", stub.ExpectArgs{"devpts", "/sysroot/dev/pts", "devpts", uintptr(0xa), "newinstance,ptmxmode=0666,mode=620"}, nil, nil),
+			call("isatty", stub.ExpectArgs{1}, false, nil),
+			call("mkdir", stub.ExpectArgs{"/sysroot/dev/mqueue", os.FileMode(0750)}, nil, nil),
+			call("mount", stub.ExpectArgs{"mqueue", "/sysroot/dev/mqueue", "mqueue", uintptr(0xe), ""}, nil, nil),
+		}, nil},
+
+		{"remount", &Params{ParentPerm: 0750, RetainSession: true}, &MountDevOp{
+			Target: MustAbs("/dev/"),
+		}, nil, nil, []stub.Call{
+			call("mountTmpfs", stub.ExpectArgs{"devtmpfs", "/sysroot/dev", uintptr(0x6), 0, os.FileMode(0750)}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/null", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/null", "/sysroot/dev/null", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/zero", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/zero", "/sysroot/dev/zero", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/full", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/full", "/sysroot/dev/full", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/random", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/random", "/sysroot/dev/random", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/urandom", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/urandom", "/sysroot/dev/urandom", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/tty", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/tty", "/sysroot/dev/tty", uintptr(0), true}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/0", "/sysroot/dev/stdin"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/1", "/sysroot/dev/stdout"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/2", "/sysroot/dev/stderr"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd", "/sysroot/dev/fd"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/kcore", "/sysroot/dev/core"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"pts/ptmx", "/sysroot/dev/ptmx"}, nil, nil),
+			call("mkdir", stub.ExpectArgs{"/sysroot/dev/shm", os.FileMode(0750)}, nil, nil),
+			call("mkdir", stub.ExpectArgs{"/sysroot/dev/pts", os.FileMode(0750)}, nil, nil),
+			call("mount", stub.ExpectArgs{"devpts", "/sysroot/dev/pts", "devpts", uintptr(0xa), "newinstance,ptmxmode=0666,mode=620"}, nil, nil),
+			call("isatty", stub.ExpectArgs{1}, true, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/console", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/1"}, "/dev/pts/2", nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/pts/2", "/sysroot/dev/console", uintptr(0), false}, nil, nil),
+			call("remount", stub.ExpectArgs{"/sysroot/dev", uintptr(1)}, nil, stub.UniqueError(0)),
+		}, stub.UniqueError(0)},
+
+		{"success no mqueue", &Params{ParentPerm: 0750, RetainSession: true}, &MountDevOp{
+			Target: MustAbs("/dev/"),
+		}, nil, nil, []stub.Call{
+			call("mountTmpfs", stub.ExpectArgs{"devtmpfs", "/sysroot/dev", uintptr(0x6), 0, os.FileMode(0750)}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/null", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/null", "/sysroot/dev/null", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/zero", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/zero", "/sysroot/dev/zero", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/full", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/full", "/sysroot/dev/full", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/random", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/random", "/sysroot/dev/random", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/urandom", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/urandom", "/sysroot/dev/urandom", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/tty", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/tty", "/sysroot/dev/tty", uintptr(0), true}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/0", "/sysroot/dev/stdin"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/1", "/sysroot/dev/stdout"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/2", "/sysroot/dev/stderr"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd", "/sysroot/dev/fd"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/kcore", "/sysroot/dev/core"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"pts/ptmx", "/sysroot/dev/ptmx"}, nil, nil),
+			call("mkdir", stub.ExpectArgs{"/sysroot/dev/shm", os.FileMode(0750)}, nil, nil),
+			call("mkdir", stub.ExpectArgs{"/sysroot/dev/pts", os.FileMode(0750)}, nil, nil),
+			call("mount", stub.ExpectArgs{"devpts", "/sysroot/dev/pts", "devpts", uintptr(0xa), "newinstance,ptmxmode=0666,mode=620"}, nil, nil),
+			call("isatty", stub.ExpectArgs{1}, true, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/console", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/1"}, "/dev/pts/2", nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/pts/2", "/sysroot/dev/console", uintptr(0), false}, nil, nil),
+			call("remount", stub.ExpectArgs{"/sysroot/dev", uintptr(1)}, nil, nil),
+			call("mountTmpfs", stub.ExpectArgs{"tmpfs", "/sysroot/dev/shm", uintptr(0x6), 0, os.FileMode(01777)}, nil, nil),
+		}, nil},
+
+		{"success rw", &Params{ParentPerm: 0750, RetainSession: true}, &MountDevOp{
+			Target: MustAbs("/dev/"),
+			Mqueue: true,
+			Write:  true,
+		}, nil, nil, []stub.Call{
+			call("mountTmpfs", stub.ExpectArgs{"devtmpfs", "/sysroot/dev", uintptr(0x6), 0, os.FileMode(0750)}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/null", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/null", "/sysroot/dev/null", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/zero", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/zero", "/sysroot/dev/zero", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/full", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/full", "/sysroot/dev/full", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/random", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/random", "/sysroot/dev/random", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/urandom", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/urandom", "/sysroot/dev/urandom", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/tty", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/tty", "/sysroot/dev/tty", uintptr(0), true}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/0", "/sysroot/dev/stdin"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/1", "/sysroot/dev/stdout"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/2", "/sysroot/dev/stderr"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd", "/sysroot/dev/fd"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/kcore", "/sysroot/dev/core"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"pts/ptmx", "/sysroot/dev/ptmx"}, nil, nil),
+			call("mkdir", stub.ExpectArgs{"/sysroot/dev/shm", os.FileMode(0750)}, nil, nil),
+			call("mkdir", stub.ExpectArgs{"/sysroot/dev/pts", os.FileMode(0750)}, nil, nil),
+			call("mount", stub.ExpectArgs{"devpts", "/sysroot/dev/pts", "devpts", uintptr(0xa), "newinstance,ptmxmode=0666,mode=620"}, nil, nil),
+			call("isatty", stub.ExpectArgs{1}, true, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/console", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/1"}, "/dev/pts/2", nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/pts/2", "/sysroot/dev/console", uintptr(0), false}, nil, nil),
+			call("mkdir", stub.ExpectArgs{"/sysroot/dev/mqueue", os.FileMode(0750)}, nil, nil),
+			call("mount", stub.ExpectArgs{"mqueue", "/sysroot/dev/mqueue", "mqueue", uintptr(0xe), ""}, nil, nil),
+		}, nil},
+
+		{"success", &Params{ParentPerm: 0750, RetainSession: true}, &MountDevOp{
+			Target: MustAbs("/dev/"),
+			Mqueue: true,
+		}, nil, nil, []stub.Call{
+			call("mountTmpfs", stub.ExpectArgs{"devtmpfs", "/sysroot/dev", uintptr(0x6), 0, os.FileMode(0750)}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/null", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/null", "/sysroot/dev/null", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/zero", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/zero", "/sysroot/dev/zero", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/full", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/full", "/sysroot/dev/full", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/random", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/random", "/sysroot/dev/random", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/urandom", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/urandom", "/sysroot/dev/urandom", uintptr(0), true}, nil, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/tty", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/tty", "/sysroot/dev/tty", uintptr(0), true}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/0", "/sysroot/dev/stdin"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/1", "/sysroot/dev/stdout"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd/2", "/sysroot/dev/stderr"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/self/fd", "/sysroot/dev/fd"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/kcore", "/sysroot/dev/core"}, nil, nil),
+			call("symlink", stub.ExpectArgs{"pts/ptmx", "/sysroot/dev/ptmx"}, nil, nil),
+			call("mkdir", stub.ExpectArgs{"/sysroot/dev/shm", os.FileMode(0750)}, nil, nil),
+			call("mkdir", stub.ExpectArgs{"/sysroot/dev/pts", os.FileMode(0750)}, nil, nil),
+			call("mount", stub.ExpectArgs{"devpts", "/sysroot/dev/pts", "devpts", uintptr(0xa), "newinstance,ptmxmode=0666,mode=620"}, nil, nil),
+			call("isatty", stub.ExpectArgs{1}, true, nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/dev/console", os.FileMode(0444), os.FileMode(0750)}, nil, nil),
+			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/1"}, "/dev/pts/2", nil),
+			call("bindMount", stub.ExpectArgs{"/host/dev/pts/2", "/sysroot/dev/console", uintptr(0), false}, nil, nil),
+			call("mkdir", stub.ExpectArgs{"/sysroot/dev/mqueue", os.FileMode(0750)}, nil, nil),
+			call("mount", stub.ExpectArgs{"mqueue", "/sysroot/dev/mqueue", "mqueue", uintptr(0xe), ""}, nil, nil),
+			call("remount", stub.ExpectArgs{"/sysroot/dev", uintptr(1)}, nil, nil),
+			call("mountTmpfs", stub.ExpectArgs{"tmpfs", "/sysroot/dev/shm", uintptr(0x6), 0, os.FileMode(01777)}, nil, nil),
+		}, nil},
+	})
+
+	checkOpsValid(t, []opValidTestCase{
+		{"nil", (*MountDevOp)(nil), false},
+		{"zero", new(MountDevOp), false},
+		{"valid", &MountDevOp{Target: MustAbs("/dev/")}, true},
+	})
+
+	checkOpsBuilder(t, []opsBuilderTestCase{
+		{"dev", new(Ops).Dev(MustAbs("/dev/"), true), Ops{
+			&MountDevOp{
+				Target: MustAbs("/dev/"),
+				Mqueue: true,
+			},
+		}},
+
+		{"dev writable", new(Ops).DevWritable(MustAbs("/.hakurei/dev/"), false), Ops{
+			&MountDevOp{
+				Target: MustAbs("/.hakurei/dev/"),
+				Write:  true,
+			},
+		}},
+	})
+
+	checkOpIs(t, []opIsTestCase{
+		{"zero", new(MountDevOp), new(MountDevOp), false},
+
+		{"write differs", &MountDevOp{
+			Target: MustAbs("/dev/"),
+			Mqueue: true,
+		}, &MountDevOp{
+			Target: MustAbs("/dev/"),
+			Mqueue: true,
+			Write:  true,
+		}, false},
+
+		{"mqueue differs", &MountDevOp{
+			Target: MustAbs("/dev/"),
+		}, &MountDevOp{
+			Target: MustAbs("/dev/"),
+			Mqueue: true,
+		}, false},
+
+		{"target differs", &MountDevOp{
+			Target: MustAbs("/"),
+			Mqueue: true,
+		}, &MountDevOp{
+			Target: MustAbs("/dev/"),
+			Mqueue: true,
+		}, false},
+
+		{"equals", &MountDevOp{
+			Target: MustAbs("/dev/"),
+			Mqueue: true,
+		}, &MountDevOp{
+			Target: MustAbs("/dev/"),
+			Mqueue: true,
+		}, true},
+	})
+
+	checkOpMeta(t, []opMetaTestCase{
+		{"mqueue", &MountDevOp{
+			Target: MustAbs("/dev/"),
+			Mqueue: true,
+		}, "mounting", `dev on "/dev/" with mqueue`},
+
+		{"dev", &MountDevOp{
+			Target: MustAbs("/dev/"),
+		}, "mounting", `dev on "/dev/"`},
+	})
+}

container/initmkdir.go

@@ -0,0 +1,36 @@
+package container
+
+import (
+	"encoding/gob"
+	"fmt"
+	"os"
+)
+
+func init() { gob.Register(new(MkdirOp)) }
+
+// Mkdir appends an [Op] that creates a directory in the container filesystem.
+func (f *Ops) Mkdir(name *Absolute, perm os.FileMode) *Ops {
+	*f = append(*f, &MkdirOp{name, perm})
+	return f
+}
+
+// MkdirOp creates a directory at container Path with permission bits set to Perm.
+type MkdirOp struct {
+	Path *Absolute
+	Perm os.FileMode
+}
+
+func (m *MkdirOp) Valid() bool                                { return m != nil && m.Path != nil }
+func (m *MkdirOp) early(*setupState, syscallDispatcher) error { return nil }
+func (m *MkdirOp) apply(_ *setupState, k syscallDispatcher) error {
+	return k.mkdirAll(toSysroot(m.Path.String()), m.Perm)
+}
+
+func (m *MkdirOp) Is(op Op) bool {
+	vm, ok := op.(*MkdirOp)
+	return ok && m.Valid() && vm.Valid() &&
+		m.Path.Is(vm.Path) &&
+		m.Perm == vm.Perm
+}
+func (*MkdirOp) prefix() (string, bool) { return "creating", true }
+func (m *MkdirOp) String() string       { return fmt.Sprintf("directory %q perm %s", m.Path, m.Perm) }

container/initmkdir_test.go

@@ -0,0 +1,44 @@
+package container
+
+import (
+	"os"
+	"testing"
+
+	"hakurei.app/container/stub"
+)
+
+func TestMkdirOp(t *testing.T) {
+	checkOpBehaviour(t, []opBehaviourTestCase{
+		{"success", new(Params), &MkdirOp{
+			Path: MustAbs("/.hakurei"),
+			Perm: 0500,
+		}, nil, nil, []stub.Call{
+			call("mkdirAll", stub.ExpectArgs{"/sysroot/.hakurei", os.FileMode(0500)}, nil, nil),
+		}, nil},
+	})
+
+	checkOpsValid(t, []opValidTestCase{
+		{"nil", (*MkdirOp)(nil), false},
+		{"zero", new(MkdirOp), false},
+		{"valid", &MkdirOp{Path: MustAbs("/.hakurei")}, true},
+	})
+
+	checkOpsBuilder(t, []opsBuilderTestCase{
+		{"etc", new(Ops).Mkdir(MustAbs("/etc/"), 0), Ops{
+			&MkdirOp{Path: MustAbs("/etc/")},
+		}},
+	})
+
+	checkOpIs(t, []opIsTestCase{
+		{"zero", new(MkdirOp), new(MkdirOp), false},
+		{"path differs", &MkdirOp{Path: MustAbs("/"), Perm: 0755}, &MkdirOp{Path: MustAbs("/etc/"), Perm: 0755}, false},
+		{"perm differs", &MkdirOp{Path: MustAbs("/")}, &MkdirOp{Path: MustAbs("/"), Perm: 0755}, false},
+		{"equals", &MkdirOp{Path: MustAbs("/")}, &MkdirOp{Path: MustAbs("/")}, true},
+	})
+
+	checkOpMeta(t, []opMetaTestCase{
+		{"etc", &MkdirOp{
+			Path: MustAbs("/etc/"),
+		}, "creating", `directory "/etc/" perm ----------`},
+	})
+}

container/initoverlay.go

@@ -0,0 +1,215 @@
+package container
+
+import (
+	"encoding/gob"
+	"fmt"
+	"slices"
+	"strings"
+)
+
+const (
+	// intermediate root file name pattern for [MountOverlayOp.Upper];
+	// remains after apply returns
+	intermediatePatternOverlayUpper = "overlay.upper.*"
+	// intermediate root file name pattern for [MountOverlayOp.Work];
+	// remains after apply returns
+	intermediatePatternOverlayWork = "overlay.work.*"
+)
+
+func init() { gob.Register(new(MountOverlayOp)) }
+
+const (
+	// OverlayEphemeralUnexpectedUpper is set when [MountOverlayOp.Work] is nil
+	// and [MountOverlayOp.Upper] holds an unexpected value.
+	OverlayEphemeralUnexpectedUpper = iota
+	// OverlayReadonlyLower is set when [MountOverlayOp.Lower] contains less than
+	// two entries when mounting readonly.
+	OverlayReadonlyLower
+	// OverlayEmptyLower is set when [MountOverlayOp.Lower] has length of zero.
+	OverlayEmptyLower
+)
+
+// OverlayArgumentError is returned for [MountOverlayOp] supplied with invalid argument.
+type OverlayArgumentError struct {
+	Type  uintptr
+	Value string
+}
+
+func (e *OverlayArgumentError) Error() string {
+	switch e.Type {
+	case OverlayEphemeralUnexpectedUpper:
+		return fmt.Sprintf("upperdir has unexpected value %q", e.Value)
+
+	case OverlayReadonlyLower:
+		return "readonly overlay requires at least two lowerdir"
+
+	case OverlayEmptyLower:
+		return "overlay requires at least one lowerdir"
+
+	default:
+		return fmt.Sprintf("invalid overlay argument error %#x", e.Type)
+	}
+}
+
+// Overlay appends an [Op] that mounts the overlay pseudo filesystem on [MountOverlayOp.Target].
+func (f *Ops) Overlay(target, state, work *Absolute, layers ...*Absolute) *Ops {
+	*f = append(*f, &MountOverlayOp{
+		Target: target,
+		Lower:  layers,
+		Upper:  state,
+		Work:   work,
+	})
+	return f
+}
+
+// OverlayEphemeral appends an [Op] that mounts the overlay pseudo filesystem on [MountOverlayOp.Target]
+// with an ephemeral upperdir and workdir.
+func (f *Ops) OverlayEphemeral(target *Absolute, layers ...*Absolute) *Ops {
+	return f.Overlay(target, AbsFHSRoot, nil, layers...)
+}
+
+// OverlayReadonly appends an [Op] that mounts the overlay pseudo filesystem readonly on [MountOverlayOp.Target]
+func (f *Ops) OverlayReadonly(target *Absolute, layers ...*Absolute) *Ops {
+	return f.Overlay(target, nil, nil, layers...)
+}
+
+// MountOverlayOp mounts [FstypeOverlay] on container path Target.
+type MountOverlayOp struct {
+	Target *Absolute
+
+	// Any filesystem, does not need to be on a writable filesystem.
+	Lower []*Absolute
+	// formatted for [OptionOverlayLowerdir], resolved, prefixed and escaped during early
+	lower []string
+	// The upperdir is normally on a writable filesystem.
+	//
+	// If Work is nil and Upper holds the special value [AbsFHSRoot],
+	// an ephemeral upperdir and workdir will be set up.
+	//
+	// If both Work and Upper are nil, upperdir and workdir is omitted and the overlay is mounted readonly.
+	Upper *Absolute
+	// formatted for [OptionOverlayUpperdir], resolved, prefixed and escaped during early
+	upper string
+	// The workdir needs to be an empty directory on the same filesystem as upperdir.
+	Work *Absolute
+	// formatted for [OptionOverlayWorkdir], resolved, prefixed and escaped during early
+	work string
+
+	ephemeral bool
+
+	// used internally for mounting to the intermediate root
+	noPrefix bool
+}
+
+func (o *MountOverlayOp) Valid() bool {
+	if o == nil {
+		return false
+	}
+	if o.Work != nil && o.Upper == nil {
+		return false
+	}
+	if slices.Contains(o.Lower, nil) {
+		return false
+	}
+	return o.Target != nil
+}
+
+func (o *MountOverlayOp) early(_ *setupState, k syscallDispatcher) error {
+	if o.Work == nil && o.Upper != nil {
+		switch o.Upper.String() {
+		case FHSRoot: // ephemeral
+			o.ephemeral = true // intermediate root not yet available
+
+		default:
+			return &OverlayArgumentError{OverlayEphemeralUnexpectedUpper, o.Upper.String()}
+		}
+	}
+	// readonly handled in apply
+
+	if !o.ephemeral {
+		if o.Upper != o.Work && (o.Upper == nil || o.Work == nil) {
+			// unreachable
+			return OpStateError("overlay")
+		}
+
+		if o.Upper != nil {
+			if v, err := k.evalSymlinks(o.Upper.String()); err != nil {
+				return err
+			} else {
+				o.upper = EscapeOverlayDataSegment(toHost(v))
+			}
+		}
+
+		if o.Work != nil {
+			if v, err := k.evalSymlinks(o.Work.String()); err != nil {
+				return err
+			} else {
+				o.work = EscapeOverlayDataSegment(toHost(v))
+			}
+		}
+	}
+
+	o.lower = make([]string, len(o.Lower))
+	for i, a := range o.Lower { // nil checked in Valid
+		if v, err := k.evalSymlinks(a.String()); err != nil {
+			return err
+		} else {
+			o.lower[i] = EscapeOverlayDataSegment(toHost(v))
+		}
+	}
+	return nil
+}
+
+func (o *MountOverlayOp) apply(state *setupState, k syscallDispatcher) error {
+	target := o.Target.String()
+	if !o.noPrefix {
+		target = toSysroot(target)
+	}
+	if err := k.mkdirAll(target, state.ParentPerm); err != nil {
+		return err
+	}
+
+	if o.ephemeral {
+		var err error
+		// these directories are created internally, therefore early (absolute, symlink, prefix, escape) is bypassed
+		if o.upper, err = k.mkdirTemp(FHSRoot, intermediatePatternOverlayUpper); err != nil {
+			return err
+		}
+		if o.work, err = k.mkdirTemp(FHSRoot, intermediatePatternOverlayWork); err != nil {
+			return err
+		}
+	}
+
+	options := make([]string, 0, 4)
+
+	if o.upper == zeroString && o.work == zeroString { // readonly
+		if len(o.Lower) < 2 {
+			return &OverlayArgumentError{OverlayReadonlyLower, zeroString}
+		}
+		// "upperdir=" and "workdir=" may be omitted. In that case the overlay will be read-only
+	} else {
+		if len(o.Lower) == 0 {
+			return &OverlayArgumentError{OverlayEmptyLower, zeroString}
+		}
+		options = append(options,
+			OptionOverlayUpperdir+"="+o.upper,
+			OptionOverlayWorkdir+"="+o.work)
+	}
+	options = append(options,
+		OptionOverlayLowerdir+"="+strings.Join(o.lower, SpecialOverlayPath),
+		OptionOverlayUserxattr)
+
+	return k.mount(SourceOverlay, target, FstypeOverlay, 0, strings.Join(options, SpecialOverlayOption))
+}
+
+func (o *MountOverlayOp) Is(op Op) bool {
+	vo, ok := op.(*MountOverlayOp)
+	return ok && o.Valid() && vo.Valid() &&
+		o.Target.Is(vo.Target) &&
+		slices.EqualFunc(o.Lower, vo.Lower, func(a *Absolute, v *Absolute) bool { return a.Is(v) }) &&
+		o.Upper.Is(vo.Upper) && o.Work.Is(vo.Work)
+}
+func (*MountOverlayOp) prefix() (string, bool) { return "mounting", true }
+func (o *MountOverlayOp) String() string {
+	return fmt.Sprintf("overlay on %q with %d layers", o.Target, len(o.Lower))
+}

container/initoverlay_test.go

@@ -0,0 +1,396 @@
+package container
+
+import (
+	"errors"
+	"os"
+	"testing"
+
+	"hakurei.app/container/stub"
+)
+
+func TestMountOverlayOp(t *testing.T) {
+	t.Run("argument error", func(t *testing.T) {
+		testCases := []struct {
+			name string
+			err  *OverlayArgumentError
+			want string
+		}{
+			{"unexpected upper", &OverlayArgumentError{OverlayEphemeralUnexpectedUpper, "/proc/"},
+				`upperdir has unexpected value "/proc/"`},
+
+			{"lower ro short", &OverlayArgumentError{OverlayReadonlyLower, zeroString},
+				"readonly overlay requires at least two lowerdir"},
+
+			{"lower short", &OverlayArgumentError{OverlayEmptyLower, zeroString},
+				"overlay requires at least one lowerdir"},
+
+			{"oob", &OverlayArgumentError{0xdeadbeef, zeroString},
+				"invalid overlay argument error 0xdeadbeef"},
+		}
+		for _, tc := range testCases {
+			t.Run(tc.name, func(t *testing.T) {
+				if got := tc.err.Error(); got != tc.want {
+					t.Errorf("Error: %q, want %q", got, tc.want)
+				}
+			})
+		}
+	})
+
+	checkOpBehaviour(t, []opBehaviourTestCase{
+		{"mkdirTemp invalid ephemeral", &Params{ParentPerm: 0705}, &MountOverlayOp{
+			Target: MustAbs("/"),
+			Lower: []*Absolute{
+				MustAbs("/var/lib/planterette/base/debian:f92c9052"),
+				MustAbs("/var/lib/planterette/app/org.chromium.Chromium@debian:f92c9052"),
+			},
+			Upper: MustAbs("/proc/"),
+		}, nil, &OverlayArgumentError{OverlayEphemeralUnexpectedUpper, "/proc/"}, nil, nil},
+
+		{"mkdirTemp upper ephemeral", &Params{ParentPerm: 0705}, &MountOverlayOp{
+			Target: MustAbs("/"),
+			Lower: []*Absolute{
+				MustAbs("/var/lib/planterette/base/debian:f92c9052"),
+				MustAbs("/var/lib/planterette/app/org.chromium.Chromium@debian:f92c9052"),
+			},
+			Upper: MustAbs("/"),
+		}, []stub.Call{
+			call("evalSymlinks", stub.ExpectArgs{"/var/lib/planterette/base/debian:f92c9052"}, "/var/lib/planterette/base/debian:f92c9052", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/var/lib/planterette/app/org.chromium.Chromium@debian:f92c9052"}, "/var/lib/planterette/app/org.chromium.Chromium@debian:f92c9052", nil),
+		}, nil, []stub.Call{
+			call("mkdirAll", stub.ExpectArgs{"/sysroot", os.FileMode(0705)}, nil, nil),
+			call("mkdirTemp", stub.ExpectArgs{"/", "overlay.upper.*"}, "overlay.upper.32768", stub.UniqueError(6)),
+		}, stub.UniqueError(6)},
+
+		{"mkdirTemp work ephemeral", &Params{ParentPerm: 0705}, &MountOverlayOp{
+			Target: MustAbs("/"),
+			Lower: []*Absolute{
+				MustAbs("/var/lib/planterette/base/debian:f92c9052"),
+				MustAbs("/var/lib/planterette/app/org.chromium.Chromium@debian:f92c9052"),
+			},
+			Upper: MustAbs("/"),
+		}, []stub.Call{
+			call("evalSymlinks", stub.ExpectArgs{"/var/lib/planterette/base/debian:f92c9052"}, "/var/lib/planterette/base/debian:f92c9052", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/var/lib/planterette/app/org.chromium.Chromium@debian:f92c9052"}, "/var/lib/planterette/app/org.chromium.Chromium@debian:f92c9052", nil),
+		}, nil, []stub.Call{
+			call("mkdirAll", stub.ExpectArgs{"/sysroot", os.FileMode(0705)}, nil, nil),
+			call("mkdirTemp", stub.ExpectArgs{"/", "overlay.upper.*"}, "overlay.upper.32768", nil),
+			call("mkdirTemp", stub.ExpectArgs{"/", "overlay.work.*"}, "overlay.work.32768", stub.UniqueError(5)),
+		}, stub.UniqueError(5)},
+
+		{"success ephemeral", &Params{ParentPerm: 0705}, &MountOverlayOp{
+			Target: MustAbs("/"),
+			Lower: []*Absolute{
+				MustAbs("/var/lib/planterette/base/debian:f92c9052"),
+				MustAbs("/var/lib/planterette/app/org.chromium.Chromium@debian:f92c9052"),
+			},
+			Upper: MustAbs("/"),
+		}, []stub.Call{
+			call("evalSymlinks", stub.ExpectArgs{"/var/lib/planterette/base/debian:f92c9052"}, "/var/lib/planterette/base/debian:f92c9052", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/var/lib/planterette/app/org.chromium.Chromium@debian:f92c9052"}, "/var/lib/planterette/app/org.chromium.Chromium@debian:f92c9052", nil),
+		}, nil, []stub.Call{
+			call("mkdirAll", stub.ExpectArgs{"/sysroot", os.FileMode(0705)}, nil, nil),
+			call("mkdirTemp", stub.ExpectArgs{"/", "overlay.upper.*"}, "overlay.upper.32768", nil),
+			call("mkdirTemp", stub.ExpectArgs{"/", "overlay.work.*"}, "overlay.work.32768", nil),
+			call("mount", stub.ExpectArgs{"overlay", "/sysroot", "overlay", uintptr(0), "" +
+				"upperdir=overlay.upper.32768," +
+				"workdir=overlay.work.32768," +
+				"lowerdir=" +
+				`/host/var/lib/planterette/base/debian\:f92c9052:` +
+				`/host/var/lib/planterette/app/org.chromium.Chromium@debian\:f92c9052,` +
+				"userxattr"}, nil, nil),
+		}, nil},
+
+		{"short lower ro", &Params{ParentPerm: 0755}, &MountOverlayOp{
+			Target: MustAbs("/nix/store"),
+			Lower: []*Absolute{
+				MustAbs("/mnt-root/nix/.ro-store"),
+			},
+		}, []stub.Call{
+			call("evalSymlinks", stub.ExpectArgs{"/mnt-root/nix/.ro-store"}, "/mnt-root/nix/.ro-store", nil),
+		}, nil, []stub.Call{
+			call("mkdirAll", stub.ExpectArgs{"/sysroot/nix/store", os.FileMode(0755)}, nil, nil),
+		}, &OverlayArgumentError{OverlayReadonlyLower, zeroString}},
+
+		{"success ro noPrefix", &Params{ParentPerm: 0755}, &MountOverlayOp{
+			Target: MustAbs("/nix/store"),
+			Lower: []*Absolute{
+				MustAbs("/mnt-root/nix/.ro-store"),
+				MustAbs("/mnt-root/nix/.ro-store0"),
+			},
+			noPrefix: true,
+		}, []stub.Call{
+			call("evalSymlinks", stub.ExpectArgs{"/mnt-root/nix/.ro-store"}, "/mnt-root/nix/.ro-store", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/mnt-root/nix/.ro-store0"}, "/mnt-root/nix/.ro-store0", nil),
+		}, nil, []stub.Call{
+			call("mkdirAll", stub.ExpectArgs{"/nix/store", os.FileMode(0755)}, nil, nil),
+			call("mount", stub.ExpectArgs{"overlay", "/nix/store", "overlay", uintptr(0), "" +
+				"lowerdir=" +
+				"/host/mnt-root/nix/.ro-store:" +
+				"/host/mnt-root/nix/.ro-store0," +
+				"userxattr"}, nil, nil),
+		}, nil},
+
+		{"success ro", &Params{ParentPerm: 0755}, &MountOverlayOp{
+			Target: MustAbs("/nix/store"),
+			Lower: []*Absolute{
+				MustAbs("/mnt-root/nix/.ro-store"),
+				MustAbs("/mnt-root/nix/.ro-store0"),
+			},
+		}, []stub.Call{
+			call("evalSymlinks", stub.ExpectArgs{"/mnt-root/nix/.ro-store"}, "/mnt-root/nix/.ro-store", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/mnt-root/nix/.ro-store0"}, "/mnt-root/nix/.ro-store0", nil),
+		}, nil, []stub.Call{
+			call("mkdirAll", stub.ExpectArgs{"/sysroot/nix/store", os.FileMode(0755)}, nil, nil),
+			call("mount", stub.ExpectArgs{"overlay", "/sysroot/nix/store", "overlay", uintptr(0), "" +
+				"lowerdir=" +
+				"/host/mnt-root/nix/.ro-store:" +
+				"/host/mnt-root/nix/.ro-store0," +
+				"userxattr"}, nil, nil),
+		}, nil},
+
+		{"nil lower", &Params{ParentPerm: 0700}, &MountOverlayOp{
+			Target: MustAbs("/nix/store"),
+			Upper:  MustAbs("/mnt-root/nix/.rw-store/upper"),
+			Work:   MustAbs("/mnt-root/nix/.rw-store/work"),
+		}, []stub.Call{
+			call("evalSymlinks", stub.ExpectArgs{"/mnt-root/nix/.rw-store/upper"}, "/mnt-root/nix/.rw-store/.upper", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/mnt-root/nix/.rw-store/work"}, "/mnt-root/nix/.rw-store/.work", nil),
+		}, nil, []stub.Call{
+			call("mkdirAll", stub.ExpectArgs{"/sysroot/nix/store", os.FileMode(0700)}, nil, nil),
+		}, &OverlayArgumentError{OverlayEmptyLower, zeroString}},
+
+		{"evalSymlinks upper", &Params{ParentPerm: 0700}, &MountOverlayOp{
+			Target: MustAbs("/nix/store"),
+			Lower:  []*Absolute{MustAbs("/mnt-root/nix/.ro-store")},
+			Upper:  MustAbs("/mnt-root/nix/.rw-store/upper"),
+			Work:   MustAbs("/mnt-root/nix/.rw-store/work"),
+		}, []stub.Call{
+			call("evalSymlinks", stub.ExpectArgs{"/mnt-root/nix/.rw-store/upper"}, "/mnt-root/nix/.rw-store/.upper", stub.UniqueError(4)),
+		}, stub.UniqueError(4), nil, nil},
+
+		{"evalSymlinks work", &Params{ParentPerm: 0700}, &MountOverlayOp{
+			Target: MustAbs("/nix/store"),
+			Lower:  []*Absolute{MustAbs("/mnt-root/nix/.ro-store")},
+			Upper:  MustAbs("/mnt-root/nix/.rw-store/upper"),
+			Work:   MustAbs("/mnt-root/nix/.rw-store/work"),
+		}, []stub.Call{
+			call("evalSymlinks", stub.ExpectArgs{"/mnt-root/nix/.rw-store/upper"}, "/mnt-root/nix/.rw-store/.upper", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/mnt-root/nix/.rw-store/work"}, "/mnt-root/nix/.rw-store/.work", stub.UniqueError(3)),
+		}, stub.UniqueError(3), nil, nil},
+
+		{"evalSymlinks lower", &Params{ParentPerm: 0700}, &MountOverlayOp{
+			Target: MustAbs("/nix/store"),
+			Lower:  []*Absolute{MustAbs("/mnt-root/nix/.ro-store")},
+			Upper:  MustAbs("/mnt-root/nix/.rw-store/upper"),
+			Work:   MustAbs("/mnt-root/nix/.rw-store/work"),
+		}, []stub.Call{
+			call("evalSymlinks", stub.ExpectArgs{"/mnt-root/nix/.rw-store/upper"}, "/mnt-root/nix/.rw-store/.upper", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/mnt-root/nix/.rw-store/work"}, "/mnt-root/nix/.rw-store/.work", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/mnt-root/nix/.ro-store"}, "/mnt-root/nix/ro-store", stub.UniqueError(2)),
+		}, stub.UniqueError(2), nil, nil},
+
+		{"mkdirAll", &Params{ParentPerm: 0700}, &MountOverlayOp{
+			Target: MustAbs("/nix/store"),
+			Lower:  []*Absolute{MustAbs("/mnt-root/nix/.ro-store")},
+			Upper:  MustAbs("/mnt-root/nix/.rw-store/upper"),
+			Work:   MustAbs("/mnt-root/nix/.rw-store/work"),
+		}, []stub.Call{
+			call("evalSymlinks", stub.ExpectArgs{"/mnt-root/nix/.rw-store/upper"}, "/mnt-root/nix/.rw-store/.upper", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/mnt-root/nix/.rw-store/work"}, "/mnt-root/nix/.rw-store/.work", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/mnt-root/nix/.ro-store"}, "/mnt-root/nix/ro-store", nil),
+		}, nil, []stub.Call{
+			call("mkdirAll", stub.ExpectArgs{"/sysroot/nix/store", os.FileMode(0700)}, nil, stub.UniqueError(1)),
+		}, stub.UniqueError(1)},
+
+		{"mount", &Params{ParentPerm: 0700}, &MountOverlayOp{
+			Target: MustAbs("/nix/store"),
+			Lower:  []*Absolute{MustAbs("/mnt-root/nix/.ro-store")},
+			Upper:  MustAbs("/mnt-root/nix/.rw-store/upper"),
+			Work:   MustAbs("/mnt-root/nix/.rw-store/work"),
+		}, []stub.Call{
+			call("evalSymlinks", stub.ExpectArgs{"/mnt-root/nix/.rw-store/upper"}, "/mnt-root/nix/.rw-store/.upper", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/mnt-root/nix/.rw-store/work"}, "/mnt-root/nix/.rw-store/.work", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/mnt-root/nix/.ro-store"}, "/mnt-root/nix/ro-store", nil),
+		}, nil, []stub.Call{
+			call("mkdirAll", stub.ExpectArgs{"/sysroot/nix/store", os.FileMode(0700)}, nil, nil),
+			call("mount", stub.ExpectArgs{"overlay", "/sysroot/nix/store", "overlay", uintptr(0), "upperdir=/host/mnt-root/nix/.rw-store/.upper,workdir=/host/mnt-root/nix/.rw-store/.work,lowerdir=/host/mnt-root/nix/ro-store,userxattr"}, nil, stub.UniqueError(0)),
+		}, stub.UniqueError(0)},
+
+		{"success single layer", &Params{ParentPerm: 0700}, &MountOverlayOp{
+			Target: MustAbs("/nix/store"),
+			Lower:  []*Absolute{MustAbs("/mnt-root/nix/.ro-store")},
+			Upper:  MustAbs("/mnt-root/nix/.rw-store/upper"),
+			Work:   MustAbs("/mnt-root/nix/.rw-store/work"),
+		}, []stub.Call{
+			call("evalSymlinks", stub.ExpectArgs{"/mnt-root/nix/.rw-store/upper"}, "/mnt-root/nix/.rw-store/.upper", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/mnt-root/nix/.rw-store/work"}, "/mnt-root/nix/.rw-store/.work", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/mnt-root/nix/.ro-store"}, "/mnt-root/nix/ro-store", nil),
+		}, nil, []stub.Call{
+			call("mkdirAll", stub.ExpectArgs{"/sysroot/nix/store", os.FileMode(0700)}, nil, nil),
+			call("mount", stub.ExpectArgs{"overlay", "/sysroot/nix/store", "overlay", uintptr(0), "" +
+				"upperdir=/host/mnt-root/nix/.rw-store/.upper," +
+				"workdir=/host/mnt-root/nix/.rw-store/.work," +
+				"lowerdir=/host/mnt-root/nix/ro-store," +
+				"userxattr"}, nil, nil),
+		}, nil},
+
+		{"success", &Params{ParentPerm: 0700}, &MountOverlayOp{
+			Target: MustAbs("/nix/store"),
+			Lower: []*Absolute{
+				MustAbs("/mnt-root/nix/.ro-store"),
+				MustAbs("/mnt-root/nix/.ro-store0"),
+				MustAbs("/mnt-root/nix/.ro-store1"),
+				MustAbs("/mnt-root/nix/.ro-store2"),
+				MustAbs("/mnt-root/nix/.ro-store3"),
+			},
+			Upper: MustAbs("/mnt-root/nix/.rw-store/upper"),
+			Work:  MustAbs("/mnt-root/nix/.rw-store/work"),
+		}, []stub.Call{
+			call("evalSymlinks", stub.ExpectArgs{"/mnt-root/nix/.rw-store/upper"}, "/mnt-root/nix/.rw-store/.upper", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/mnt-root/nix/.rw-store/work"}, "/mnt-root/nix/.rw-store/.work", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/mnt-root/nix/.ro-store"}, "/mnt-root/nix/ro-store", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/mnt-root/nix/.ro-store0"}, "/mnt-root/nix/ro-store0", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/mnt-root/nix/.ro-store1"}, "/mnt-root/nix/ro-store1", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/mnt-root/nix/.ro-store2"}, "/mnt-root/nix/ro-store2", nil),
+			call("evalSymlinks", stub.ExpectArgs{"/mnt-root/nix/.ro-store3"}, "/mnt-root/nix/ro-store3", nil),
+		}, nil, []stub.Call{
+			call("mkdirAll", stub.ExpectArgs{"/sysroot/nix/store", os.FileMode(0700)}, nil, nil),
+			call("mount", stub.ExpectArgs{"overlay", "/sysroot/nix/store", "overlay", uintptr(0), "" +
+				"upperdir=/host/mnt-root/nix/.rw-store/.upper," +
+				"workdir=/host/mnt-root/nix/.rw-store/.work," +
+				"lowerdir=" +
+				"/host/mnt-root/nix/ro-store:" +
+				"/host/mnt-root/nix/ro-store0:" +
+				"/host/mnt-root/nix/ro-store1:" +
+				"/host/mnt-root/nix/ro-store2:" +
+				"/host/mnt-root/nix/ro-store3," +
+				"userxattr"}, nil, nil),
+		}, nil},
+	})
+
+	t.Run("unreachable", func(t *testing.T) {
+		t.Run("nil Upper non-nil Work not ephemeral", func(t *testing.T) {
+			wantErr := OpStateError("overlay")
+			if err := (&MountOverlayOp{
+				Work: MustAbs("/"),
+			}).early(nil, nil); !errors.Is(err, wantErr) {
+				t.Errorf("apply: error = %v, want %v", err, wantErr)
+			}
+		})
+	})
+
+	checkOpsValid(t, []opValidTestCase{
+		{"nil", (*MountOverlayOp)(nil), false},
+		{"zero", new(MountOverlayOp), false},
+		{"nil lower", &MountOverlayOp{Target: MustAbs("/"), Lower: []*Absolute{nil}}, false},
+		{"ro", &MountOverlayOp{Target: MustAbs("/"), Lower: []*Absolute{MustAbs("/")}}, true},
+		{"ro work", &MountOverlayOp{Target: MustAbs("/"), Work: MustAbs("/tmp/")}, false},
+		{"rw", &MountOverlayOp{Target: MustAbs("/"), Lower: []*Absolute{MustAbs("/")}, Upper: MustAbs("/"), Work: MustAbs("/")}, true},
+	})
+
+	checkOpsBuilder(t, []opsBuilderTestCase{
+		{"full", new(Ops).Overlay(
+			MustAbs("/nix/store"),
+			MustAbs("/mnt-root/nix/.rw-store/upper"),
+			MustAbs("/mnt-root/nix/.rw-store/work"),
+			MustAbs("/mnt-root/nix/.ro-store"),
+		), Ops{
+			&MountOverlayOp{
+				Target: MustAbs("/nix/store"),
+				Lower:  []*Absolute{MustAbs("/mnt-root/nix/.ro-store")},
+				Upper:  MustAbs("/mnt-root/nix/.rw-store/upper"),
+				Work:   MustAbs("/mnt-root/nix/.rw-store/work"),
+			},
+		}},
+
+		{"ephemeral", new(Ops).OverlayEphemeral(MustAbs("/nix/store"), MustAbs("/mnt-root/nix/.ro-store")), Ops{
+			&MountOverlayOp{
+				Target: MustAbs("/nix/store"),
+				Lower:  []*Absolute{MustAbs("/mnt-root/nix/.ro-store")},
+				Upper:  MustAbs("/"),
+			},
+		}},
+
+		{"readonly", new(Ops).OverlayReadonly(MustAbs("/nix/store"), MustAbs("/mnt-root/nix/.ro-store")), Ops{
+			&MountOverlayOp{
+				Target: MustAbs("/nix/store"),
+				Lower:  []*Absolute{MustAbs("/mnt-root/nix/.ro-store")},
+			},
+		}},
+	})
+
+	checkOpIs(t, []opIsTestCase{
+		{"zero", new(MountOverlayOp), new(MountOverlayOp), false},
+
+		{"differs target", &MountOverlayOp{
+			Target: MustAbs("/nix/store/differs"),
+			Lower:  []*Absolute{MustAbs("/mnt-root/nix/.ro-store")},
+			Upper:  MustAbs("/mnt-root/nix/.rw-store/upper"),
+			Work:   MustAbs("/mnt-root/nix/.rw-store/work"),
+		}, &MountOverlayOp{
+			Target: MustAbs("/nix/store"),
+			Lower:  []*Absolute{MustAbs("/mnt-root/nix/.ro-store")},
+			Upper:  MustAbs("/mnt-root/nix/.rw-store/upper"),
+			Work:   MustAbs("/mnt-root/nix/.rw-store/work")}, false},
+
+		{"differs lower", &MountOverlayOp{
+			Target: MustAbs("/nix/store"),
+			Lower:  []*Absolute{MustAbs("/mnt-root/nix/.ro-store/differs")},
+			Upper:  MustAbs("/mnt-root/nix/.rw-store/upper"),
+			Work:   MustAbs("/mnt-root/nix/.rw-store/work"),
+		}, &MountOverlayOp{
+			Target: MustAbs("/nix/store"),
+			Lower:  []*Absolute{MustAbs("/mnt-root/nix/.ro-store")},
+			Upper:  MustAbs("/mnt-root/nix/.rw-store/upper"),
+			Work:   MustAbs("/mnt-root/nix/.rw-store/work")}, false},
+
+		{"differs upper", &MountOverlayOp{
+			Target: MustAbs("/nix/store"),
+			Lower:  []*Absolute{MustAbs("/mnt-root/nix/.ro-store")},
+			Upper:  MustAbs("/mnt-root/nix/.rw-store/upper/differs"),
+			Work:   MustAbs("/mnt-root/nix/.rw-store/work"),
+		}, &MountOverlayOp{
+			Target: MustAbs("/nix/store"),
+			Lower:  []*Absolute{MustAbs("/mnt-root/nix/.ro-store")},
+			Upper:  MustAbs("/mnt-root/nix/.rw-store/upper"),
+			Work:   MustAbs("/mnt-root/nix/.rw-store/work")}, false},
+
+		{"differs work", &MountOverlayOp{
+			Target: MustAbs("/nix/store"),
+			Lower:  []*Absolute{MustAbs("/mnt-root/nix/.ro-store")},
+			Upper:  MustAbs("/mnt-root/nix/.rw-store/upper"),
+			Work:   MustAbs("/mnt-root/nix/.rw-store/work/differs"),
+		}, &MountOverlayOp{
+			Target: MustAbs("/nix/store"),
+			Lower:  []*Absolute{MustAbs("/mnt-root/nix/.ro-store")},
+			Upper:  MustAbs("/mnt-root/nix/.rw-store/upper"),
+			Work:   MustAbs("/mnt-root/nix/.rw-store/work")}, false},
+
+		{"equals ro", &MountOverlayOp{
+			Target: MustAbs("/nix/store"),
+			Lower:  []*Absolute{MustAbs("/mnt-root/nix/.ro-store")},
+		}, &MountOverlayOp{
+			Target: MustAbs("/nix/store"),
+			Lower:  []*Absolute{MustAbs("/mnt-root/nix/.ro-store")}}, true},
+
+		{"equals", &MountOverlayOp{
+			Target: MustAbs("/nix/store"),
+			Lower:  []*Absolute{MustAbs("/mnt-root/nix/.ro-store")},
+			Upper:  MustAbs("/mnt-root/nix/.rw-store/upper"),
+			Work:   MustAbs("/mnt-root/nix/.rw-store/work"),
+		}, &MountOverlayOp{
+			Target: MustAbs("/nix/store"),
+			Lower:  []*Absolute{MustAbs("/mnt-root/nix/.ro-store")},
+			Upper:  MustAbs("/mnt-root/nix/.rw-store/upper"),
+			Work:   MustAbs("/mnt-root/nix/.rw-store/work")}, true},
+	})
+
+	checkOpMeta(t, []opMetaTestCase{
+		{"nix", &MountOverlayOp{
+			Target: MustAbs("/nix/store"),
+			Lower:  []*Absolute{MustAbs("/mnt-root/nix/.ro-store")},
+			Upper:  MustAbs("/mnt-root/nix/.rw-store/upper"),
+			Work:   MustAbs("/mnt-root/nix/.rw-store/work"),
+		}, "mounting", `overlay on "/nix/store" with 1 layers`},
+	})
+}

container/initplace.go

@@ -0,0 +1,75 @@
+package container
+
+import (
+	"encoding/gob"
+	"fmt"
+	"syscall"
+)
+
+const (
+	// intermediate root file name pattern for [TmpfileOp]
+	intermediatePatternTmpfile = "tmp.*"
+)
+
+func init() { gob.Register(new(TmpfileOp)) }
+
+// Place appends an [Op] that places a file in container path [TmpfileOp.Path] containing [TmpfileOp.Data].
+func (f *Ops) Place(name *Absolute, data []byte) *Ops {
+	*f = append(*f, &TmpfileOp{name, data})
+	return f
+}
+
+// PlaceP is like Place but writes the address of [TmpfileOp.Data] to the pointer dataP points to.
+func (f *Ops) PlaceP(name *Absolute, dataP **[]byte) *Ops {
+	t := &TmpfileOp{Path: name}
+	*dataP = &t.Data
+
+	*f = append(*f, t)
+	return f
+}
+
+// TmpfileOp places a file on container Path containing Data.
+type TmpfileOp struct {
+	Path *Absolute
+	Data []byte
+}
+
+func (t *TmpfileOp) Valid() bool                                { return t != nil && t.Path != nil }
+func (t *TmpfileOp) early(*setupState, syscallDispatcher) error { return nil }
+func (t *TmpfileOp) apply(state *setupState, k syscallDispatcher) error {
+	var tmpPath string
+	if f, err := k.createTemp(FHSRoot, intermediatePatternTmpfile); err != nil {
+		return err
+	} else if _, err = f.Write(t.Data); err != nil {
+		return err
+	} else if err = f.Close(); err != nil {
+		return err
+	} else {
+		tmpPath = f.Name()
+	}
+
+	target := toSysroot(t.Path.String())
+	if err := k.ensureFile(target, 0444, state.ParentPerm); err != nil {
+		return err
+	} else if err = k.bindMount(
+		tmpPath,
+		target,
+		syscall.MS_RDONLY|syscall.MS_NODEV,
+	); err != nil {
+		return err
+	} else if err = k.remove(tmpPath); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (t *TmpfileOp) Is(op Op) bool {
+	vt, ok := op.(*TmpfileOp)
+	return ok && t.Valid() && vt.Valid() &&
+		t.Path.Is(vt.Path) &&
+		string(t.Data) == string(vt.Data)
+}
+func (*TmpfileOp) prefix() (string, bool) { return "placing", true }
+func (t *TmpfileOp) String() string {
+	return fmt.Sprintf("tmpfile %q (%d bytes)", t.Path, len(t.Data))
+}

container/initplace_test.go

@@ -0,0 +1,133 @@
+package container
+
+import (
+	"os"
+	"testing"
+
+	"hakurei.app/container/stub"
+)
+
+func TestTmpfileOp(t *testing.T) {
+	const sampleDataString = `chronos:x:65534:65534:Hakurei:/var/empty:/bin/zsh`
+	var (
+		samplePath = MustAbs("/etc/passwd")
+		sampleData = []byte(sampleDataString)
+	)
+
+	checkOpBehaviour(t, []opBehaviourTestCase{
+		{"createTemp", &Params{ParentPerm: 0700}, &TmpfileOp{
+			Path: samplePath,
+			Data: sampleData,
+		}, nil, nil, []stub.Call{
+			call("createTemp", stub.ExpectArgs{"/", "tmp.*"}, newCheckedFile(t, "tmp.32768", sampleDataString, nil), stub.UniqueError(5)),
+		}, stub.UniqueError(5)},
+
+		{"Write", &Params{ParentPerm: 0700}, &TmpfileOp{
+			Path: samplePath,
+			Data: sampleData,
+		}, nil, nil, []stub.Call{
+			call("createTemp", stub.ExpectArgs{"/", "tmp.*"}, writeErrOsFile{stub.UniqueError(4)}, nil),
+		}, stub.UniqueError(4)},
+
+		{"Close", &Params{ParentPerm: 0700}, &TmpfileOp{
+			Path: samplePath,
+			Data: sampleData,
+		}, nil, nil, []stub.Call{
+			call("createTemp", stub.ExpectArgs{"/", "tmp.*"}, newCheckedFile(t, "tmp.32768", sampleDataString, stub.UniqueError(3)), nil),
+		}, stub.UniqueError(3)},
+
+		{"ensureFile", &Params{ParentPerm: 0700}, &TmpfileOp{
+			Path: samplePath,
+			Data: sampleData,
+		}, nil, nil, []stub.Call{
+			call("createTemp", stub.ExpectArgs{"/", "tmp.*"}, newCheckedFile(t, "tmp.32768", sampleDataString, nil), nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/etc/passwd", os.FileMode(0444), os.FileMode(0700)}, nil, stub.UniqueError(2)),
+		}, stub.UniqueError(2)},
+
+		{"bindMount", &Params{ParentPerm: 0700}, &TmpfileOp{
+			Path: samplePath,
+			Data: sampleData,
+		}, nil, nil, []stub.Call{
+			call("createTemp", stub.ExpectArgs{"/", "tmp.*"}, newCheckedFile(t, "tmp.32768", sampleDataString, nil), nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/etc/passwd", os.FileMode(0444), os.FileMode(0700)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"tmp.32768", "/sysroot/etc/passwd", uintptr(0x5), false}, nil, stub.UniqueError(1)),
+		}, stub.UniqueError(1)},
+
+		{"remove", &Params{ParentPerm: 0700}, &TmpfileOp{
+			Path: samplePath,
+			Data: sampleData,
+		}, nil, nil, []stub.Call{
+			call("createTemp", stub.ExpectArgs{"/", "tmp.*"}, newCheckedFile(t, "tmp.32768", sampleDataString, nil), nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/etc/passwd", os.FileMode(0444), os.FileMode(0700)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"tmp.32768", "/sysroot/etc/passwd", uintptr(0x5), false}, nil, nil),
+			call("remove", stub.ExpectArgs{"tmp.32768"}, nil, stub.UniqueError(0)),
+		}, stub.UniqueError(0)},
+
+		{"success", &Params{ParentPerm: 0700}, &TmpfileOp{
+			Path: samplePath,
+			Data: sampleData,
+		}, nil, nil, []stub.Call{
+			call("createTemp", stub.ExpectArgs{"/", "tmp.*"}, newCheckedFile(t, "tmp.32768", sampleDataString, nil), nil),
+			call("ensureFile", stub.ExpectArgs{"/sysroot/etc/passwd", os.FileMode(0444), os.FileMode(0700)}, nil, nil),
+			call("bindMount", stub.ExpectArgs{"tmp.32768", "/sysroot/etc/passwd", uintptr(0x5), false}, nil, nil),
+			call("remove", stub.ExpectArgs{"tmp.32768"}, nil, nil),
+		}, nil},
+	})
+
+	checkOpsValid(t, []opValidTestCase{
+		{"nil", (*TmpfileOp)(nil), false},
+		{"zero", new(TmpfileOp), false},
+		{"valid", &TmpfileOp{Path: samplePath}, true},
+	})
+
+	checkOpsBuilder(t, []opsBuilderTestCase{
+		{"noref", new(Ops).Place(samplePath, sampleData), Ops{
+			&TmpfileOp{
+				Path: samplePath,
+				Data: sampleData,
+			},
+		}},
+
+		{"ref", new(Ops).PlaceP(samplePath, new(*[]byte)), Ops{
+			&TmpfileOp{
+				Path: samplePath,
+				Data: []byte{},
+			},
+		}},
+	})
+
+	checkOpIs(t, []opIsTestCase{
+		{"zero", new(TmpfileOp), new(TmpfileOp), false},
+
+		{"differs path", &TmpfileOp{
+			Path: MustAbs("/etc/group"),
+			Data: sampleData,
+		}, &TmpfileOp{
+			Path: samplePath,
+			Data: sampleData,
+		}, false},
+
+		{"differs data", &TmpfileOp{
+			Path: samplePath,
+			Data: append(sampleData, 0),
+		}, &TmpfileOp{
+			Path: samplePath,
+			Data: sampleData,
+		}, false},
+
+		{"equals", &TmpfileOp{
+			Path: samplePath,
+			Data: sampleData,
+		}, &TmpfileOp{
+			Path: samplePath,
+			Data: sampleData,
+		}, true},
+	})
+
+	checkOpMeta(t, []opMetaTestCase{
+		{"passwd", &TmpfileOp{
+			Path: samplePath,
+			Data: sampleData,
+		}, "placing", `tmpfile "/etc/passwd" (49 bytes)`},
+	})
+}

container/initproc.go

@@ -0,0 +1,36 @@
+package container
+
+import (
+	"encoding/gob"
+	"fmt"
+	. "syscall"
+)
+
+func init() { gob.Register(new(MountProcOp)) }
+
+// Proc appends an [Op] that mounts a private instance of proc.
+func (f *Ops) Proc(target *Absolute) *Ops {
+	*f = append(*f, &MountProcOp{target})
+	return f
+}
+
+// MountProcOp mounts a new instance of [FstypeProc] on container path Target.
+type MountProcOp struct{ Target *Absolute }
+
+func (p *MountProcOp) Valid() bool                                { return p != nil && p.Target != nil }
+func (p *MountProcOp) early(*setupState, syscallDispatcher) error { return nil }
+func (p *MountProcOp) apply(state *setupState, k syscallDispatcher) error {
+	target := toSysroot(p.Target.String())
+	if err := k.mkdirAll(target, state.ParentPerm); err != nil {
+		return err
+	}
+	return k.mount(SourceProc, target, FstypeProc, MS_NOSUID|MS_NOEXEC|MS_NODEV, zeroString)
+}
+
+func (p *MountProcOp) Is(op Op) bool {
+	vp, ok := op.(*MountProcOp)
+	return ok && p.Valid() && vp.Valid() &&
+		p.Target.Is(vp.Target)
+}
+func (*MountProcOp) prefix() (string, bool) { return "mounting", true }
+func (p *MountProcOp) String() string       { return fmt.Sprintf("proc on %q", p.Target) }

container/initproc_test.go

@@ -0,0 +1,60 @@
+package container
+
+import (
+	"os"
+	"testing"
+
+	"hakurei.app/container/stub"
+)
+
+func TestMountProcOp(t *testing.T) {
+	checkOpBehaviour(t, []opBehaviourTestCase{
+		{"mkdir", &Params{ParentPerm: 0755},
+			&MountProcOp{
+				Target: MustAbs("/proc/"),
+			}, nil, nil, []stub.Call{
+				call("mkdirAll", stub.ExpectArgs{"/sysroot/proc", os.FileMode(0755)}, nil, stub.UniqueError(0)),
+			}, stub.UniqueError(0)},
+
+		{"success", &Params{ParentPerm: 0700},
+			&MountProcOp{
+				Target: MustAbs("/proc/"),
+			}, nil, nil, []stub.Call{
+				call("mkdirAll", stub.ExpectArgs{"/sysroot/proc", os.FileMode(0700)}, nil, nil),
+				call("mount", stub.ExpectArgs{"proc", "/sysroot/proc", "proc", uintptr(0xe), ""}, nil, nil),
+			}, nil},
+	})
+
+	checkOpsValid(t, []opValidTestCase{
+		{"nil", (*MountProcOp)(nil), false},
+		{"zero", new(MountProcOp), false},
+		{"valid", &MountProcOp{Target: MustAbs("/proc/")}, true},
+	})
+
+	checkOpsBuilder(t, []opsBuilderTestCase{
+		{"proc", new(Ops).Proc(MustAbs("/proc/")), Ops{
+			&MountProcOp{Target: MustAbs("/proc/")},
+		}},
+	})
+
+	checkOpIs(t, []opIsTestCase{
+		{"zero", new(MountProcOp), new(MountProcOp), false},
+
+		{"target differs", &MountProcOp{
+			Target: MustAbs("/proc/nonexistent"),
+		}, &MountProcOp{
+			Target: MustAbs("/proc/"),
+		}, false},
+
+		{"equals", &MountProcOp{
+			Target: MustAbs("/proc/"),
+		}, &MountProcOp{
+			Target: MustAbs("/proc/"),
+		}, true},
+	})
+
+	checkOpMeta(t, []opMetaTestCase{
+		{"proc", &MountProcOp{Target: MustAbs("/proc/")},
+			"mounting", `proc on "/proc/"`},
+	})
+}

container/initremount.go

@@ -0,0 +1,35 @@
+package container
+
+import (
+	"encoding/gob"
+	"fmt"
+)
+
+func init() { gob.Register(new(RemountOp)) }
+
+// Remount appends an [Op] that applies [RemountOp.Flags] on container path [RemountOp.Target].
+func (f *Ops) Remount(target *Absolute, flags uintptr) *Ops {
+	*f = append(*f, &RemountOp{target, flags})
+	return f
+}
+
+// RemountOp remounts Target with Flags.
+type RemountOp struct {
+	Target *Absolute
+	Flags  uintptr
+}
+
+func (r *RemountOp) Valid() bool                              { return r != nil && r.Target != nil }
+func (*RemountOp) early(*setupState, syscallDispatcher) error { return nil }
+func (r *RemountOp) apply(_ *setupState, k syscallDispatcher) error {
+	return k.remount(toSysroot(r.Target.String()), r.Flags)
+}
+
+func (r *RemountOp) Is(op Op) bool {
+	vr, ok := op.(*RemountOp)
+	return ok && r.Valid() && vr.Valid() &&
+		r.Target.Is(vr.Target) &&
+		r.Flags == vr.Flags
+}
+func (*RemountOp) prefix() (string, bool) { return "remounting", true }
+func (r *RemountOp) String() string       { return fmt.Sprintf("%q flags %#x", r.Target, r.Flags) }

container/initremount_test.go

@@ -0,0 +1,69 @@
+package container
+
+import (
+	"syscall"
+	"testing"
+
+	"hakurei.app/container/stub"
+)
+
+func TestRemountOp(t *testing.T) {
+	checkOpBehaviour(t, []opBehaviourTestCase{
+		{"success", new(Params), &RemountOp{
+			Target: MustAbs("/"),
+			Flags:  syscall.MS_RDONLY,
+		}, nil, nil, []stub.Call{
+			call("remount", stub.ExpectArgs{"/sysroot", uintptr(1)}, nil, nil),
+		}, nil},
+	})
+
+	checkOpsValid(t, []opValidTestCase{
+		{"nil", (*RemountOp)(nil), false},
+		{"zero", new(RemountOp), false},
+		{"valid", &RemountOp{Target: MustAbs("/"), Flags: syscall.MS_RDONLY}, true},
+	})
+
+	checkOpsBuilder(t, []opsBuilderTestCase{
+		{"root", new(Ops).Remount(MustAbs("/"), syscall.MS_RDONLY), Ops{
+			&RemountOp{
+				Target: MustAbs("/"),
+				Flags:  syscall.MS_RDONLY,
+			},
+		}},
+	})
+
+	checkOpIs(t, []opIsTestCase{
+		{"zero", new(RemountOp), new(RemountOp), false},
+
+		{"target differs", &RemountOp{
+			Target: MustAbs("/dev/"),
+			Flags:  syscall.MS_RDONLY,
+		}, &RemountOp{
+			Target: MustAbs("/"),
+			Flags:  syscall.MS_RDONLY,
+		}, false},
+
+		{"flags differs", &RemountOp{
+			Target: MustAbs("/"),
+			Flags:  syscall.MS_RDONLY | syscall.MS_NODEV,
+		}, &RemountOp{
+			Target: MustAbs("/"),
+			Flags:  syscall.MS_RDONLY,
+		}, false},
+
+		{"equals", &RemountOp{
+			Target: MustAbs("/"),
+			Flags:  syscall.MS_RDONLY,
+		}, &RemountOp{
+			Target: MustAbs("/"),
+			Flags:  syscall.MS_RDONLY,
+		}, true},
+	})
+
+	checkOpMeta(t, []opMetaTestCase{
+		{"root", &RemountOp{
+			Target: MustAbs("/"),
+			Flags:  syscall.MS_RDONLY,
+		}, "remounting", `"/" flags 0x1`},
+	})
+}

container/initsymlink.go

@@ -0,0 +1,61 @@
+package container
+
+import (
+	"encoding/gob"
+	"fmt"
+	"path"
+)
+
+func init() { gob.Register(new(SymlinkOp)) }
+
+// Link appends an [Op] that creates a symlink in the container filesystem.
+func (f *Ops) Link(target *Absolute, linkName string, dereference bool) *Ops {
+	*f = append(*f, &SymlinkOp{target, linkName, dereference})
+	return f
+}
+
+// SymlinkOp optionally dereferences LinkName and creates a symlink at container path Target.
+type SymlinkOp struct {
+	Target *Absolute
+	// LinkName is an arbitrary uninterpreted pathname.
+	LinkName string
+
+	// Dereference causes LinkName to be dereferenced during early.
+	Dereference bool
+}
+
+func (l *SymlinkOp) Valid() bool { return l != nil && l.Target != nil && l.LinkName != zeroString }
+
+func (l *SymlinkOp) early(_ *setupState, k syscallDispatcher) error {
+	if l.Dereference {
+		if !isAbs(l.LinkName) {
+			return &AbsoluteError{l.LinkName}
+		}
+		if name, err := k.readlink(l.LinkName); err != nil {
+			return err
+		} else {
+			l.LinkName = name
+		}
+	}
+	return nil
+}
+
+func (l *SymlinkOp) apply(state *setupState, k syscallDispatcher) error {
+	target := toSysroot(l.Target.String())
+	if err := k.mkdirAll(path.Dir(target), state.ParentPerm); err != nil {
+		return err
+	}
+	return k.symlink(l.LinkName, target)
+}
+
+func (l *SymlinkOp) Is(op Op) bool {
+	vl, ok := op.(*SymlinkOp)
+	return ok && l.Valid() && vl.Valid() &&
+		l.Target.Is(vl.Target) &&
+		l.LinkName == vl.LinkName &&
+		l.Dereference == vl.Dereference
+}
+func (*SymlinkOp) prefix() (string, bool) { return "creating", true }
+func (l *SymlinkOp) String() string {
+	return fmt.Sprintf("symlink on %q linkname %q", l.Target, l.LinkName)
+}

container/initsymlink_test.go

@@ -0,0 +1,125 @@
+package container
+
+import (
+	"os"
+	"testing"
+
+	"hakurei.app/container/stub"
+)
+
+func TestSymlinkOp(t *testing.T) {
+	checkOpBehaviour(t, []opBehaviourTestCase{
+		{"mkdir", &Params{ParentPerm: 0700}, &SymlinkOp{
+			Target:   MustAbs("/etc/nixos"),
+			LinkName: "/etc/static/nixos",
+		}, nil, nil, []stub.Call{
+			call("mkdirAll", stub.ExpectArgs{"/sysroot/etc", os.FileMode(0700)}, nil, stub.UniqueError(1)),
+		}, stub.UniqueError(1)},
+
+		{"abs", &Params{ParentPerm: 0755}, &SymlinkOp{
+			Target:      MustAbs("/etc/mtab"),
+			LinkName:    "etc/mtab",
+			Dereference: true,
+		}, nil, &AbsoluteError{"etc/mtab"}, nil, nil},
+
+		{"readlink", &Params{ParentPerm: 0755}, &SymlinkOp{
+			Target:      MustAbs("/etc/mtab"),
+			LinkName:    "/etc/mtab",
+			Dereference: true,
+		}, []stub.Call{
+			call("readlink", stub.ExpectArgs{"/etc/mtab"}, "/proc/mounts", stub.UniqueError(0)),
+		}, stub.UniqueError(0), nil, nil},
+
+		{"success noderef", &Params{ParentPerm: 0700}, &SymlinkOp{
+			Target:   MustAbs("/etc/nixos"),
+			LinkName: "/etc/static/nixos",
+		}, nil, nil, []stub.Call{
+			call("mkdirAll", stub.ExpectArgs{"/sysroot/etc", os.FileMode(0700)}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/etc/static/nixos", "/sysroot/etc/nixos"}, nil, nil),
+		}, nil},
+
+		{"success", &Params{ParentPerm: 0755}, &SymlinkOp{
+			Target:      MustAbs("/etc/mtab"),
+			LinkName:    "/etc/mtab",
+			Dereference: true,
+		}, []stub.Call{
+			call("readlink", stub.ExpectArgs{"/etc/mtab"}, "/proc/mounts", nil),
+		}, nil, []stub.Call{
+			call("mkdirAll", stub.ExpectArgs{"/sysroot/etc", os.FileMode(0755)}, nil, nil),
+			call("symlink", stub.ExpectArgs{"/proc/mounts", "/sysroot/etc/mtab"}, nil, nil),
+		}, nil},
+	})
+
+	checkOpsValid(t, []opValidTestCase{
+		{"nil", (*SymlinkOp)(nil), false},
+		{"zero", new(SymlinkOp), false},
+		{"nil target", &SymlinkOp{LinkName: "/run/current-system"}, false},
+		{"zero linkname", &SymlinkOp{Target: MustAbs("/run/current-system")}, false},
+		{"valid", &SymlinkOp{Target: MustAbs("/run/current-system"), LinkName: "/run/current-system", Dereference: true}, true},
+	})
+
+	checkOpsBuilder(t, []opsBuilderTestCase{
+		{"current-system", new(Ops).Link(
+			MustAbs("/run/current-system"),
+			"/run/current-system",
+			true,
+		), Ops{
+			&SymlinkOp{
+				Target:      MustAbs("/run/current-system"),
+				LinkName:    "/run/current-system",
+				Dereference: true,
+			},
+		}},
+	})
+
+	checkOpIs(t, []opIsTestCase{
+		{"zero", new(SymlinkOp), new(SymlinkOp), false},
+
+		{"target differs", &SymlinkOp{
+			Target:      MustAbs("/run/current-system/differs"),
+			LinkName:    "/run/current-system",
+			Dereference: true,
+		}, &SymlinkOp{
+			Target:      MustAbs("/run/current-system"),
+			LinkName:    "/run/current-system",
+			Dereference: true,
+		}, false},
+
+		{"linkname differs", &SymlinkOp{
+			Target:      MustAbs("/run/current-system"),
+			LinkName:    "/run/current-system/differs",
+			Dereference: true,
+		}, &SymlinkOp{
+			Target:      MustAbs("/run/current-system"),
+			LinkName:    "/run/current-system",
+			Dereference: true,
+		}, false},
+
+		{"dereference differs", &SymlinkOp{
+			Target:   MustAbs("/run/current-system"),
+			LinkName: "/run/current-system",
+		}, &SymlinkOp{
+			Target:      MustAbs("/run/current-system"),
+			LinkName:    "/run/current-system",
+			Dereference: true,
+		}, false},
+
+		{"equals", &SymlinkOp{
+			Target:      MustAbs("/run/current-system"),
+			LinkName:    "/run/current-system",
+			Dereference: true,
+		}, &SymlinkOp{
+			Target:      MustAbs("/run/current-system"),
+			LinkName:    "/run/current-system",
+			Dereference: true,
+		}, true},
+	})
+
+	checkOpMeta(t, []opMetaTestCase{
+		{"current-system", &SymlinkOp{
+			Target:      MustAbs("/run/current-system"),
+			LinkName:    "/run/current-system",
+			Dereference: true,
+		}, "creating", `symlink on "/run/current-system" linkname "/run/current-system"`},
+	})
+}

container/inittmpfs.go

@@ -0,0 +1,60 @@
+package container
+
+import (
+	"encoding/gob"
+	"fmt"
+	"math"
+	"os"
+	"strconv"
+	. "syscall"
+)
+
+func init() { gob.Register(new(MountTmpfsOp)) }
+
+type TmpfsSizeError int
+
+func (e TmpfsSizeError) Error() string {
+	return "tmpfs size " + strconv.Itoa(int(e)) + " out of bounds"
+}
+
+// Tmpfs appends an [Op] that mounts tmpfs on container path [MountTmpfsOp.Path].
+func (f *Ops) Tmpfs(target *Absolute, size int, perm os.FileMode) *Ops {
+	*f = append(*f, &MountTmpfsOp{SourceTmpfsEphemeral, target, MS_NOSUID | MS_NODEV, size, perm})
+	return f
+}
+
+// Readonly appends an [Op] that mounts read-only tmpfs on container path [MountTmpfsOp.Path].
+func (f *Ops) Readonly(target *Absolute, perm os.FileMode) *Ops {
+	*f = append(*f, &MountTmpfsOp{SourceTmpfsReadonly, target, MS_RDONLY | MS_NOSUID | MS_NODEV, 0, perm})
+	return f
+}
+
+// MountTmpfsOp mounts [FstypeTmpfs] on container Path.
+type MountTmpfsOp struct {
+	FSName string
+	Path   *Absolute
+	Flags  uintptr
+	Size   int
+	Perm   os.FileMode
+}
+
+func (t *MountTmpfsOp) Valid() bool                                { return t != nil && t.Path != nil && t.FSName != zeroString }
+func (t *MountTmpfsOp) early(*setupState, syscallDispatcher) error { return nil }
+func (t *MountTmpfsOp) apply(_ *setupState, k syscallDispatcher) error {
+	if t.Size < 0 || t.Size > math.MaxUint>>1 {
+		return TmpfsSizeError(t.Size)
+	}
+	return k.mountTmpfs(t.FSName, toSysroot(t.Path.String()), t.Flags, t.Size, t.Perm)
+}
+
+func (t *MountTmpfsOp) Is(op Op) bool {
+	vt, ok := op.(*MountTmpfsOp)
+	return ok && t.Valid() && vt.Valid() &&
+		t.FSName == vt.FSName &&
+		t.Path.Is(vt.Path) &&
+		t.Flags == vt.Flags &&
+		t.Size == vt.Size &&
+		t.Perm == vt.Perm
+}
+func (*MountTmpfsOp) prefix() (string, bool) { return "mounting", true }
+func (t *MountTmpfsOp) String() string       { return fmt.Sprintf("tmpfs on %q size %d", t.Path, t.Size) }

container/inittmpfs_test.go

@@ -0,0 +1,174 @@
+package container
+
+import (
+	"os"
+	"syscall"
+	"testing"
+
+	"hakurei.app/container/stub"
+)
+
+func TestMountTmpfsOp(t *testing.T) {
+	t.Run("size error", func(t *testing.T) {
+		tmpfsSizeError := TmpfsSizeError(-1)
+		want := "tmpfs size -1 out of bounds"
+		if got := tmpfsSizeError.Error(); got != want {
+			t.Errorf("Error: %q, want %q", got, want)
+		}
+	})
+
+	checkOpBehaviour(t, []opBehaviourTestCase{
+		{"size oob", new(Params), &MountTmpfsOp{
+			Size: -1,
+		}, nil, nil, nil, TmpfsSizeError(-1)},
+
+		{"success", new(Params), &MountTmpfsOp{
+			FSName: "ephemeral",
+			Path:   MustAbs("/run/user/1000/"),
+			Size:   1 << 10,
+			Perm:   0700,
+		}, nil, nil, []stub.Call{
+			call("mountTmpfs", stub.ExpectArgs{
+				"ephemeral",              // fsname
+				"/sysroot/run/user/1000", // target
+				uintptr(0),               // flags
+				0x400,                    // size
+				os.FileMode(0700),        // perm
+			}, nil, nil),
+		}, nil},
+	})
+
+	checkOpsValid(t, []opValidTestCase{
+		{"nil", (*MountTmpfsOp)(nil), false},
+		{"zero", new(MountTmpfsOp), false},
+		{"nil path", &MountTmpfsOp{FSName: "tmpfs"}, false},
+		{"zero fsname", &MountTmpfsOp{Path: MustAbs("/tmp/")}, false},
+		{"valid", &MountTmpfsOp{FSName: "tmpfs", Path: MustAbs("/tmp/")}, true},
+	})
+
+	checkOpsBuilder(t, []opsBuilderTestCase{
+		{"runtime", new(Ops).Tmpfs(
+			MustAbs("/run/user"),
+			1<<10,
+			0755,
+		), Ops{
+			&MountTmpfsOp{
+				FSName: "ephemeral",
+				Path:   MustAbs("/run/user"),
+				Flags:  syscall.MS_NOSUID | syscall.MS_NODEV,
+				Size:   1 << 10,
+				Perm:   0755,
+			},
+		}},
+
+		{"nscd", new(Ops).Readonly(
+			MustAbs("/var/run/nscd"),
+			0755,
+		), Ops{
+			&MountTmpfsOp{
+				FSName: "readonly",
+				Path:   MustAbs("/var/run/nscd"),
+				Flags:  syscall.MS_NOSUID | syscall.MS_NODEV | syscall.MS_RDONLY,
+				Perm:   0755,
+			},
+		}},
+	})
+
+	checkOpIs(t, []opIsTestCase{
+		{"zero", new(MountTmpfsOp), new(MountTmpfsOp), false},
+
+		{"fsname differs", &MountTmpfsOp{
+			FSName: "readonly",
+			Path:   MustAbs("/run/user"),
+			Flags:  syscall.MS_NOSUID | syscall.MS_NODEV,
+			Size:   1 << 10,
+			Perm:   0755,
+		}, &MountTmpfsOp{
+			FSName: "ephemeral",
+			Path:   MustAbs("/run/user"),
+			Flags:  syscall.MS_NOSUID | syscall.MS_NODEV,
+			Size:   1 << 10,
+			Perm:   0755,
+		}, false},
+
+		{"path differs", &MountTmpfsOp{
+			FSName: "ephemeral",
+			Path:   MustAbs("/run/user/differs"),
+			Flags:  syscall.MS_NOSUID | syscall.MS_NODEV,
+			Size:   1 << 10,
+			Perm:   0755,
+		}, &MountTmpfsOp{
+			FSName: "ephemeral",
+			Path:   MustAbs("/run/user"),
+			Flags:  syscall.MS_NOSUID | syscall.MS_NODEV,
+			Size:   1 << 10,
+			Perm:   0755,
+		}, false},
+
+		{"flags differs", &MountTmpfsOp{
+			FSName: "ephemeral",
+			Path:   MustAbs("/run/user"),
+			Flags:  syscall.MS_NOSUID | syscall.MS_NODEV | syscall.MS_RDONLY,
+			Size:   1 << 10,
+			Perm:   0755,
+		}, &MountTmpfsOp{
+			FSName: "ephemeral",
+			Path:   MustAbs("/run/user"),
+			Flags:  syscall.MS_NOSUID | syscall.MS_NODEV,
+			Size:   1 << 10,
+			Perm:   0755,
+		}, false},
+
+		{"size differs", &MountTmpfsOp{
+			FSName: "ephemeral",
+			Path:   MustAbs("/run/user"),
+			Flags:  syscall.MS_NOSUID | syscall.MS_NODEV,
+			Size:   1,
+			Perm:   0755,
+		}, &MountTmpfsOp{
+			FSName: "ephemeral",
+			Path:   MustAbs("/run/user"),
+			Flags:  syscall.MS_NOSUID | syscall.MS_NODEV,
+			Size:   1 << 10,
+			Perm:   0755,
+		}, false},
+
+		{"perm differs", &MountTmpfsOp{
+			FSName: "ephemeral",
+			Path:   MustAbs("/run/user"),
+			Flags:  syscall.MS_NOSUID | syscall.MS_NODEV,
+			Size:   1 << 10,
+			Perm:   0700,
+		}, &MountTmpfsOp{
+			FSName: "ephemeral",
+			Path:   MustAbs("/run/user"),
+			Flags:  syscall.MS_NOSUID | syscall.MS_NODEV,
+			Size:   1 << 10,
+			Perm:   0755,
+		}, false},
+
+		{"equals", &MountTmpfsOp{
+			FSName: "ephemeral",
+			Path:   MustAbs("/run/user"),
+			Flags:  syscall.MS_NOSUID | syscall.MS_NODEV,
+			Size:   1 << 10,
+			Perm:   0755,
+		}, &MountTmpfsOp{
+			FSName: "ephemeral",
+			Path:   MustAbs("/run/user"),
+			Flags:  syscall.MS_NOSUID | syscall.MS_NODEV,
+			Size:   1 << 10,
+			Perm:   0755,
+		}, true},
+	})
+
+	checkOpMeta(t, []opMetaTestCase{
+		{"runtime", &MountTmpfsOp{
+			FSName: "ephemeral",
+			Path:   MustAbs("/run/user"),
+			Flags:  syscall.MS_NOSUID | syscall.MS_NODEV,
+			Size:   1 << 10,
+			Perm:   0755,
+		}, "mounting", `tmpfs on "/run/user" size 1024`},
+	})
+}

container/landlock.go

@@ -0,0 +1,239 @@
+package container
+
+import (
+	"strings"
+	"syscall"
+	"unsafe"
+
+	"hakurei.app/container/seccomp"
+)
+
+// include/uapi/linux/landlock.h
+
+const (
+	LANDLOCK_CREATE_RULESET_VERSION = 1 << iota
+)
+
+type LandlockAccessFS uintptr
+
+const (
+	LANDLOCK_ACCESS_FS_EXECUTE LandlockAccessFS = 1 << iota
+	LANDLOCK_ACCESS_FS_WRITE_FILE
+	LANDLOCK_ACCESS_FS_READ_FILE
+	LANDLOCK_ACCESS_FS_READ_DIR
+	LANDLOCK_ACCESS_FS_REMOVE_DIR
+	LANDLOCK_ACCESS_FS_REMOVE_FILE
+	LANDLOCK_ACCESS_FS_MAKE_CHAR
+	LANDLOCK_ACCESS_FS_MAKE_DIR
+	LANDLOCK_ACCESS_FS_MAKE_REG
+	LANDLOCK_ACCESS_FS_MAKE_SOCK
+	LANDLOCK_ACCESS_FS_MAKE_FIFO
+	LANDLOCK_ACCESS_FS_MAKE_BLOCK
+	LANDLOCK_ACCESS_FS_MAKE_SYM
+	LANDLOCK_ACCESS_FS_REFER
+	LANDLOCK_ACCESS_FS_TRUNCATE
+	LANDLOCK_ACCESS_FS_IOCTL_DEV
+
+	_LANDLOCK_ACCESS_FS_DELIM
+)
+
+func (f LandlockAccessFS) String() string {
+	switch f {
+	case LANDLOCK_ACCESS_FS_EXECUTE:
+		return "execute"
+
+	case LANDLOCK_ACCESS_FS_WRITE_FILE:
+		return "write_file"
+
+	case LANDLOCK_ACCESS_FS_READ_FILE:
+		return "read_file"
+
+	case LANDLOCK_ACCESS_FS_READ_DIR:
+		return "read_dir"
+
+	case LANDLOCK_ACCESS_FS_REMOVE_DIR:
+		return "remove_dir"
+
+	case LANDLOCK_ACCESS_FS_REMOVE_FILE:
+		return "remove_file"
+
+	case LANDLOCK_ACCESS_FS_MAKE_CHAR:
+		return "make_char"
+
+	case LANDLOCK_ACCESS_FS_MAKE_DIR:
+		return "make_dir"
+
+	case LANDLOCK_ACCESS_FS_MAKE_REG:
+		return "make_reg"
+
+	case LANDLOCK_ACCESS_FS_MAKE_SOCK:
+		return "make_sock"
+
+	case LANDLOCK_ACCESS_FS_MAKE_FIFO:
+		return "make_fifo"
+
+	case LANDLOCK_ACCESS_FS_MAKE_BLOCK:
+		return "make_block"
+
+	case LANDLOCK_ACCESS_FS_MAKE_SYM:
+		return "make_sym"
+
+	case LANDLOCK_ACCESS_FS_REFER:
+		return "fs_refer"
+
+	case LANDLOCK_ACCESS_FS_TRUNCATE:
+		return "fs_truncate"
+
+	case LANDLOCK_ACCESS_FS_IOCTL_DEV:
+		return "fs_ioctl_dev"
+
+	default:
+		var c []LandlockAccessFS
+		for i := LandlockAccessFS(1); i < _LANDLOCK_ACCESS_FS_DELIM; i <<= 1 {
+			if f&i != 0 {
+				c = append(c, i)
+			}
+		}
+		if len(c) == 0 {
+			return "NULL"
+		}
+		s := make([]string, len(c))
+		for i, v := range c {
+			s[i] = v.String()
+		}
+		return strings.Join(s, " ")
+	}
+}
+
+type LandlockAccessNet uintptr
+
+const (
+	LANDLOCK_ACCESS_NET_BIND_TCP LandlockAccessNet = 1 << iota
+	LANDLOCK_ACCESS_NET_CONNECT_TCP
+
+	_LANDLOCK_ACCESS_NET_DELIM
+)
+
+func (f LandlockAccessNet) String() string {
+	switch f {
+	case LANDLOCK_ACCESS_NET_BIND_TCP:
+		return "bind_tcp"
+
+	case LANDLOCK_ACCESS_NET_CONNECT_TCP:
+		return "connect_tcp"
+
+	default:
+		var c []LandlockAccessNet
+		for i := LandlockAccessNet(1); i < _LANDLOCK_ACCESS_NET_DELIM; i <<= 1 {
+			if f&i != 0 {
+				c = append(c, i)
+			}
+		}
+		if len(c) == 0 {
+			return "NULL"
+		}
+		s := make([]string, len(c))
+		for i, v := range c {
+			s[i] = v.String()
+		}
+		return strings.Join(s, " ")
+	}
+}
+
+type LandlockScope uintptr
+
+const (
+	LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET LandlockScope = 1 << iota
+	LANDLOCK_SCOPE_SIGNAL
+
+	_LANDLOCK_SCOPE_DELIM
+)
+
+func (f LandlockScope) String() string {
+	switch f {
+	case LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET:
+		return "abstract_unix_socket"
+
+	case LANDLOCK_SCOPE_SIGNAL:
+		return "signal"
+
+	default:
+		var c []LandlockScope
+		for i := LandlockScope(1); i < _LANDLOCK_SCOPE_DELIM; i <<= 1 {
+			if f&i != 0 {
+				c = append(c, i)
+			}
+		}
+		if len(c) == 0 {
+			return "NULL"
+		}
+		s := make([]string, len(c))
+		for i, v := range c {
+			s[i] = v.String()
+		}
+		return strings.Join(s, " ")
+	}
+}
+
+type RulesetAttr struct {
+	// Bitmask of handled filesystem actions.
+	HandledAccessFS LandlockAccessFS
+	// Bitmask of handled network actions.
+	HandledAccessNet LandlockAccessNet
+	// Bitmask of scopes restricting a Landlock domain from accessing outside resources (e.g. IPCs).
+	Scoped LandlockScope
+}
+
+func (rulesetAttr *RulesetAttr) String() string {
+	if rulesetAttr == nil {
+		return "NULL"
+	}
+	elems := make([]string, 0, 3)
+	if rulesetAttr.HandledAccessFS > 0 {
+		elems = append(elems, "fs: "+rulesetAttr.HandledAccessFS.String())
+	}
+	if rulesetAttr.HandledAccessNet > 0 {
+		elems = append(elems, "net: "+rulesetAttr.HandledAccessNet.String())
+	}
+	if rulesetAttr.Scoped > 0 {
+		elems = append(elems, "scoped: "+rulesetAttr.Scoped.String())
+	}
+	if len(elems) == 0 {
+		return "0"
+	}
+	return strings.Join(elems, ", ")
+}
+
+func (rulesetAttr *RulesetAttr) Create(flags uintptr) (fd int, err error) {
+	var pointer, size uintptr
+	// NULL needed for abi version
+	if rulesetAttr != nil {
+		pointer = uintptr(unsafe.Pointer(rulesetAttr))
+		size = unsafe.Sizeof(*rulesetAttr)
+	}
+
+	rulesetFd, _, errno := syscall.Syscall(seccomp.SYS_LANDLOCK_CREATE_RULESET, pointer, size, flags)
+	fd = int(rulesetFd)
+	err = errno
+
+	if fd < 0 {
+		return
+	}
+
+	if rulesetAttr != nil { // not a fd otherwise
+		syscall.CloseOnExec(fd)
+	}
+	return fd, nil
+}
+
+func LandlockGetABI() (int, error) {
+	return (*RulesetAttr)(nil).Create(LANDLOCK_CREATE_RULESET_VERSION)
+}
+
+func LandlockRestrictSelf(rulesetFd int, flags uintptr) error {
+	r, _, errno := syscall.Syscall(seccomp.SYS_LANDLOCK_RESTRICT_SELF, uintptr(rulesetFd), flags, 0)
+	if r != 0 {
+		return errno
+	}
+	return nil
+}

container/landlock_test.go

@@ -0,0 +1,61 @@
+package container_test
+
+import (
+	"testing"
+	"unsafe"
+
+	"hakurei.app/container"
+)
+
+func TestLandlockString(t *testing.T) {
+	testCases := []struct {
+		name        string
+		rulesetAttr *container.RulesetAttr
+		want        string
+	}{
+		{"nil", nil, "NULL"},
+		{"zero", new(container.RulesetAttr), "0"},
+		{"some", &container.RulesetAttr{Scoped: container.LANDLOCK_SCOPE_SIGNAL}, "scoped: signal"},
+		{"set", &container.RulesetAttr{
+			HandledAccessFS:  container.LANDLOCK_ACCESS_FS_MAKE_SYM | container.LANDLOCK_ACCESS_FS_IOCTL_DEV | container.LANDLOCK_ACCESS_FS_WRITE_FILE,
+			HandledAccessNet: container.LANDLOCK_ACCESS_NET_BIND_TCP,
+			Scoped:           container.LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET | container.LANDLOCK_SCOPE_SIGNAL,
+		}, "fs: write_file make_sym fs_ioctl_dev, net: bind_tcp, scoped: abstract_unix_socket signal"},
+		{"all", &container.RulesetAttr{
+			HandledAccessFS: container.LANDLOCK_ACCESS_FS_EXECUTE |
+				container.LANDLOCK_ACCESS_FS_WRITE_FILE |
+				container.LANDLOCK_ACCESS_FS_READ_FILE |
+				container.LANDLOCK_ACCESS_FS_READ_DIR |
+				container.LANDLOCK_ACCESS_FS_REMOVE_DIR |
+				container.LANDLOCK_ACCESS_FS_REMOVE_FILE |
+				container.LANDLOCK_ACCESS_FS_MAKE_CHAR |
+				container.LANDLOCK_ACCESS_FS_MAKE_DIR |
+				container.LANDLOCK_ACCESS_FS_MAKE_REG |
+				container.LANDLOCK_ACCESS_FS_MAKE_SOCK |
+				container.LANDLOCK_ACCESS_FS_MAKE_FIFO |
+				container.LANDLOCK_ACCESS_FS_MAKE_BLOCK |
+				container.LANDLOCK_ACCESS_FS_MAKE_SYM |
+				container.LANDLOCK_ACCESS_FS_REFER |
+				container.LANDLOCK_ACCESS_FS_TRUNCATE |
+				container.LANDLOCK_ACCESS_FS_IOCTL_DEV,
+			HandledAccessNet: container.LANDLOCK_ACCESS_NET_BIND_TCP |
+				container.LANDLOCK_ACCESS_NET_CONNECT_TCP,
+			Scoped: container.LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET |
+				container.LANDLOCK_SCOPE_SIGNAL,
+		}, "fs: execute write_file read_file read_dir remove_dir remove_file make_char make_dir make_reg make_sock make_fifo make_block make_sym fs_refer fs_truncate fs_ioctl_dev, net: bind_tcp connect_tcp, scoped: abstract_unix_socket signal"},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := tc.rulesetAttr.String(); got != tc.want {
+				t.Errorf("String: %s, want %s", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestLandlockAttrSize(t *testing.T) {
+	want := 24
+	if got := unsafe.Sizeof(container.RulesetAttr{}); got != uintptr(want) {
+		t.Errorf("Sizeof: %d, want %d", got, want)
+	}
+}

container/mount.go

@@ -4,31 +4,119 @@ import (
 	"errors"
 	"fmt"
 	"os"
-	"path/filepath"
+	"strings"
 	. "syscall"
 
 	"hakurei.app/container/vfs"
 )
 
-func (p *procPaths) bindMount(source, target string, flags uintptr, eq bool) error {
-	if eq {
-		msg.Verbosef("resolved %q flags %#x", target, flags)
-	} else {
-		msg.Verbosef("resolved %q on %q flags %#x", source, target, flags)
+/*
+Holding CAP_SYS_ADMIN within the user namespace that owns a process's mount namespace
+allows that process to create bind mounts and mount the following types of filesystems:
+- /proc (since Linux 3.8)
+- /sys (since Linux 3.8)
+- devpts (since Linux 3.9)
+- tmpfs(5) (since Linux 3.9)
+- ramfs (since Linux 3.9)
+- mqueue (since Linux 3.9)
+- bpf (since Linux 4.4)
+- overlayfs (since Linux 5.11)
+*/
+
+const (
+	// zeroString is a zero value string, it represents NULL when passed to mount.
+	zeroString = ""
+
+	// SourceNone is used when the source value is ignored,
+	// such as when remounting.
+	SourceNone = "none"
+	// SourceProc is used when mounting proc.
+	// Note that any source value is allowed when fstype is [FstypeProc].
+	SourceProc = "proc"
+	// SourceDevpts is used when mounting devpts.
+	// Note that any source value is allowed when fstype is [FstypeDevpts].
+	SourceDevpts = "devpts"
+	// SourceMqueue is used when mounting mqueue.
+	// Note that any source value is allowed when fstype is [FstypeMqueue].
+	SourceMqueue = "mqueue"
+	// SourceOverlay is used when mounting overlay.
+	// Note that any source value is allowed when fstype is [FstypeOverlay].
+	SourceOverlay = "overlay"
+
+	// SourceTmpfs is used when mounting tmpfs.
+	SourceTmpfs = "tmpfs"
+	// SourceTmpfsRootfs is used when mounting the tmpfs instance backing the intermediate root.
+	SourceTmpfsRootfs = "rootfs"
+	// SourceTmpfsDevtmpfs is used when mounting tmpfs representing a subset of host devtmpfs.
+	SourceTmpfsDevtmpfs = "devtmpfs"
+	// SourceTmpfsEphemeral is used when mounting a writable instance of tmpfs.
+	SourceTmpfsEphemeral = "ephemeral"
+	// SourceTmpfsReadonly is used when mounting a readonly instance of tmpfs.
+	SourceTmpfsReadonly = "readonly"
+
+	// FstypeNULL is used when the fstype value is ignored,
+	// such as when bind mounting or remounting.
+	FstypeNULL = zeroString
+	// FstypeProc represents the proc pseudo-filesystem.
+	// A fully visible instance of proc must be available in the mount namespace for proc to be mounted.
+	// This filesystem type is usually mounted on [FHSProc].
+	FstypeProc = "proc"
+	// FstypeDevpts represents the devpts pseudo-filesystem.
+	// This type of filesystem is usually mounted on /dev/pts.
+	FstypeDevpts = "devpts"
+	// FstypeTmpfs represents the tmpfs filesystem.
+	// This filesystem type can be mounted anywhere in the container filesystem.
+	FstypeTmpfs = "tmpfs"
+	// FstypeMqueue represents the mqueue pseudo-filesystem.
+	// This filesystem type is usually mounted on /dev/mqueue.
+	FstypeMqueue = "mqueue"
+	// FstypeOverlay represents the overlay pseudo-filesystem.
+	// This filesystem type can be mounted anywhere in the container filesystem.
+	FstypeOverlay = "overlay"
+
+	// OptionOverlayLowerdir represents the lowerdir option of the overlay pseudo-filesystem.
+	// Any filesystem, does not need to be on a writable filesystem.
+	OptionOverlayLowerdir = "lowerdir"
+	// OptionOverlayUpperdir represents the upperdir option of the overlay pseudo-filesystem.
+	// The upperdir is normally on a writable filesystem.
+	OptionOverlayUpperdir = "upperdir"
+	// OptionOverlayWorkdir represents the workdir option of the overlay pseudo-filesystem.
+	// The workdir needs to be an empty directory on the same filesystem as upperdir.
+	OptionOverlayWorkdir = "workdir"
+	// OptionOverlayUserxattr represents the userxattr option of the overlay pseudo-filesystem.
+	// Use the "user.overlay." xattr namespace instead of "trusted.overlay.".
+	OptionOverlayUserxattr = "userxattr"
+
+	// SpecialOverlayEscape is the escape string for overlay mount options.
+	SpecialOverlayEscape = `\`
+	// SpecialOverlayOption is the separator string between overlay mount options.
+	SpecialOverlayOption = ","
+	// SpecialOverlayPath is the separator string between overlay paths.
+	SpecialOverlayPath = ":"
+)
+
+// bindMount mounts source on target and recursively applies flags if MS_REC is set.
+func (p *procPaths) bindMount(source, target string, flags uintptr) error {
+	// syscallDispatcher.bindMount and procPaths.remount must not be called from this function
+
+	if err := p.k.mount(source, target, FstypeNULL, MS_SILENT|MS_BIND|flags&MS_REC, zeroString); err != nil {
+		return err
 	}
 
-	if err := Mount(source, target, "", MS_SILENT|MS_BIND|flags&MS_REC, ""); err != nil {
-		return wrapErrSuffix(err,
-			fmt.Sprintf("cannot mount %q on %q:", source, target))
-	}
+	return p.k.remount(target, flags)
+}
+
+// remount applies flags on target, recursively if MS_REC is set.
+func (p *procPaths) remount(target string, flags uintptr) error {
+	// syscallDispatcher methods bindMount, remount must not be called from this function
 
 	var targetFinal string
-	if v, err := filepath.EvalSymlinks(target); err != nil {
-		return wrapErrSelf(err)
+	if v, err := p.k.evalSymlinks(target); err != nil {
+		return err
 	} else {
 		targetFinal = v
 		if targetFinal != target {
-			msg.Verbosef("target resolves to %q", targetFinal)
+			p.k.verbosef("target resolves to %q", targetFinal)
 		}
 	}
 
@@ -37,35 +125,28 @@ func (p *procPaths) bindMount(source, target string, flags uintptr, eq bool) err
 	{
 		var destFd int
 		if err := IgnoringEINTR(func() (err error) {
-			destFd, err = Open(targetFinal, O_PATH|O_CLOEXEC, 0)
+			destFd, err = p.k.open(targetFinal, O_PATH|O_CLOEXEC, 0)
 			return
 		}); err != nil {
-			return wrapErrSuffix(err,
-				fmt.Sprintf("cannot open %q:", targetFinal))
+			return &os.PathError{Op: "open", Path: targetFinal, Err: err}
 		}
-		if v, err := os.Readlink(p.fd(destFd)); err != nil {
-			return wrapErrSelf(err)
-		} else if err = Close(destFd); err != nil {
-			return wrapErrSuffix(err,
-				fmt.Sprintf("cannot close %q:", targetFinal))
+		if v, err := p.k.readlink(p.fd(destFd)); err != nil {
+			return err
+		} else if err = p.k.close(destFd); err != nil {
+			return &os.PathError{Op: "close", Path: targetFinal, Err: err}
 		} else {
 			targetKFinal = v
 		}
 	}
 
 	mf := MS_NOSUID | flags&MS_NODEV | flags&MS_RDONLY
-	return hostProc.mountinfo(func(d *vfs.MountInfoDecoder) error {
+	return p.mountinfo(func(d *vfs.MountInfoDecoder) error {
 		n, err := d.Unfold(targetKFinal)
 		if err != nil {
-			if errors.Is(err, ESTALE) {
-				return msg.WrapErr(err,
-					fmt.Sprintf("mount point %q never appeared in mountinfo", targetKFinal))
-			}
-			return wrapErrSuffix(err,
-				"cannot unfold mount hierarchy:")
+			return err
 		}
 
-		if err = remountWithFlags(n, mf); err != nil {
+		if err = remountWithFlags(p.k, n, mf); err != nil {
 			return err
 		}
 		if flags&MS_REC == 0 {
@@ -73,8 +154,12 @@ func (p *procPaths) bindMount(source, target string, flags uintptr, eq bool) err
 		}
 
 		for cur := range n.Collective() {
-			err = remountWithFlags(cur, mf)
-			if err != nil && !errors.Is(err, EACCES) {
+			// avoid remounting twice
+			if cur == n {
+				continue
+			}
+
+			if err = remountWithFlags(p.k, cur, mf); err != nil && !errors.Is(err, EACCES) {
 				return err
 			}
 		}
@@ -83,32 +168,34 @@ func (p *procPaths) bindMount(source, target string, flags uintptr, eq bool) err
 	})
 }
 
-func remountWithFlags(n *vfs.MountInfoNode, mf uintptr) error {
+// remountWithFlags remounts mount point described by [vfs.MountInfoNode].
+func remountWithFlags(k syscallDispatcher, n *vfs.MountInfoNode, mf uintptr) error {
+	// syscallDispatcher methods bindMount, remount must not be called from this function
+
 	kf, unmatched := n.Flags()
 	if len(unmatched) != 0 {
-		msg.Verbosef("unmatched vfs options: %q", unmatched)
+		k.verbosef("unmatched vfs options: %q", unmatched)
 	}
 
 	if kf&mf != mf {
-		return wrapErrSuffix(
-			Mount("none", n.Clean, "", MS_SILENT|MS_BIND|MS_REMOUNT|kf|mf, ""),
-			fmt.Sprintf("cannot remount %q:", n.Clean))
+		return k.mount(SourceNone, n.Clean, FstypeNULL, MS_SILENT|MS_BIND|MS_REMOUNT|kf|mf, zeroString)
 	}
 	return nil
 }
 
-func mountTmpfs(fsname, name string, size int, perm os.FileMode) error {
-	target := toSysroot(name)
-	if err := os.MkdirAll(target, parentPerm(perm)); err != nil {
-		return wrapErrSelf(err)
+// mountTmpfs mounts tmpfs on target;
+// callers who wish to mount to sysroot must pass the return value of toSysroot.
+func mountTmpfs(k syscallDispatcher, fsname, target string, flags uintptr, size int, perm os.FileMode) error {
+	// syscallDispatcher.mountTmpfs must not be called from this function
+
+	if err := k.mkdirAll(target, parentPerm(perm)); err != nil {
+		return err
 	}
 	opt := fmt.Sprintf("mode=%#o", perm)
 	if size > 0 {
 		opt += fmt.Sprintf(",size=%d", size)
 	}
-	return wrapErrSuffix(
-		Mount(fsname, target, "tmpfs", MS_NOSUID|MS_NODEV, opt),
-		fmt.Sprintf("cannot mount tmpfs on %q:", name))
+	return k.mount(fsname, target, FstypeTmpfs, flags, opt)
 }
 
 func parentPerm(perm os.FileMode) os.FileMode {
@@ -121,3 +208,20 @@ func parentPerm(perm os.FileMode) os.FileMode {
 	}
 	return os.FileMode(pperm)
 }
+
+// EscapeOverlayDataSegment escapes a string for formatting into the data argument of an overlay mount call.
+func EscapeOverlayDataSegment(s string) string {
+	if s == zeroString {
+		return zeroString
+	}
+
+	if f := strings.SplitN(s, "\x00", 2); len(f) > 0 {
+		s = f[0]
+	}
+
+	return strings.NewReplacer(
+		SpecialOverlayEscape, SpecialOverlayEscape+SpecialOverlayEscape,
+		SpecialOverlayOption, SpecialOverlayEscape+SpecialOverlayOption,
+		SpecialOverlayPath, SpecialOverlayEscape+SpecialOverlayPath,
+	).Replace(s)
+}

container/mount_test.go

@@ -0,0 +1,303 @@
+package container
+
+import (
+	"os"
+	"syscall"
+	"testing"
+
+	"hakurei.app/container/stub"
+	"hakurei.app/container/vfs"
+)
+
+func TestBindMount(t *testing.T) {
+	checkSimple(t, "bindMount", []simpleTestCase{
+		{"mount", func(k syscallDispatcher) error {
+			return newProcPaths(k, hostPath).bindMount("/host/nix", "/sysroot/nix", syscall.MS_RDONLY)
+		}, stub.Expect{Calls: []stub.Call{
+			call("mount", stub.ExpectArgs{"/host/nix", "/sysroot/nix", "", uintptr(0x9000), ""}, nil, stub.UniqueError(0xbad)),
+		}}, stub.UniqueError(0xbad)},
+
+		{"success ne", func(k syscallDispatcher) error {
+			return newProcPaths(k, hostPath).bindMount("/host/nix", "/sysroot/.host-nix", syscall.MS_RDONLY)
+		}, stub.Expect{Calls: []stub.Call{
+			call("mount", stub.ExpectArgs{"/host/nix", "/sysroot/.host-nix", "", uintptr(0x9000), ""}, nil, nil),
+			call("remount", stub.ExpectArgs{"/sysroot/.host-nix", uintptr(1)}, nil, nil),
+		}}, nil},
+
+		{"success", func(k syscallDispatcher) error {
+			return newProcPaths(k, hostPath).bindMount("/host/nix", "/sysroot/nix", syscall.MS_RDONLY)
+		}, stub.Expect{Calls: []stub.Call{
+			call("mount", stub.ExpectArgs{"/host/nix", "/sysroot/nix", "", uintptr(0x9000), ""}, nil, nil),
+			call("remount", stub.ExpectArgs{"/sysroot/nix", uintptr(1)}, nil, nil),
+		}}, nil},
+	})
+}
+
+func TestRemount(t *testing.T) {
+	const sampleMountinfoNix = `254 407 253:0 / /host rw,relatime master:1 - ext4 /dev/disk/by-label/nixos rw
+255 254 0:28 / /host/mnt/.ro-cwd ro,noatime master:2 - 9p cwd ro,access=client,msize=16384,trans=virtio
+256 254 0:29 / /host/nix/.ro-store rw,relatime master:3 - 9p nix-store rw,cache=f,access=client,msize=16384,trans=virtio
+257 254 0:30 / /host/nix/store rw,relatime master:4 - overlay overlay rw,lowerdir=/mnt-root/nix/.ro-store,upperdir=/mnt-root/nix/.rw-store/upper,workdir=/mnt-root/nix/.rw-store/work
+258 257 0:30 / /host/nix/store ro,relatime master:5 - overlay overlay rw,lowerdir=/mnt-root/nix/.ro-store,upperdir=/mnt-root/nix/.rw-store/upper,workdir=/mnt-root/nix/.rw-store/work
+259 254 0:33 / /host/tmp/shared rw,relatime master:6 - 9p shared rw,access=client,msize=16384,trans=virtio
+260 254 0:34 / /host/tmp/xchg rw,relatime master:7 - 9p xchg rw,access=client,msize=16384,trans=virtio
+261 254 0:22 / /host/proc rw,nosuid,nodev,noexec,relatime master:8 - proc proc rw
+262 254 0:25 / /host/sys rw,nosuid,nodev,noexec,relatime master:9 - sysfs sysfs rw
+263 262 0:7 / /host/sys/kernel/security rw,nosuid,nodev,noexec,relatime master:10 - securityfs securityfs rw
+264 262 0:35 /../../.. /host/sys/fs/cgroup rw,nosuid,nodev,noexec,relatime master:11 - cgroup2 cgroup2 rw,nsdelegate,memory_recursiveprot
+265 262 0:36 / /host/sys/fs/pstore rw,nosuid,nodev,noexec,relatime master:12 - pstore pstore rw
+266 262 0:37 / /host/sys/fs/bpf rw,nosuid,nodev,noexec,relatime master:13 - bpf bpf rw,mode=700
+267 262 0:12 / /host/sys/kernel/tracing rw,nosuid,nodev,noexec,relatime master:20 - tracefs tracefs rw
+268 262 0:8 / /host/sys/kernel/debug rw,nosuid,nodev,noexec,relatime master:21 - debugfs debugfs rw
+269 262 0:44 / /host/sys/kernel/config rw,nosuid,nodev,noexec,relatime master:64 - configfs configfs rw
+270 262 0:45 / /host/sys/fs/fuse/connections rw,nosuid,nodev,noexec,relatime master:66 - fusectl fusectl rw
+271 254 0:6 / /host/dev rw,nosuid master:14 - devtmpfs devtmpfs rw,size=200532k,nr_inodes=498943,mode=755
+324 271 0:20 / /host/dev/pts rw,nosuid,noexec,relatime master:15 - devpts devpts rw,gid=3,mode=620,ptmxmode=666
+378 271 0:21 / /host/dev/shm rw,nosuid,nodev master:16 - tmpfs tmpfs rw
+379 271 0:19 / /host/dev/mqueue rw,nosuid,nodev,noexec,relatime master:19 - mqueue mqueue rw
+388 271 0:38 / /host/dev/hugepages rw,nosuid,nodev,relatime master:22 - hugetlbfs hugetlbfs rw,pagesize=2M
+397 254 0:23 / /host/run rw,nosuid,nodev master:17 - tmpfs tmpfs rw,size=1002656k,mode=755
+398 397 0:24 / /host/run/keys rw,nosuid,nodev,relatime master:18 - ramfs ramfs rw,mode=750
+399 397 0:39 / /host/run/credentials/systemd-journald.service ro,nosuid,nodev,noexec,relatime,nosymfollow master:23 - tmpfs tmpfs rw,size=1024k,nr_inodes=1024,mode=700,noswap
+400 397 0:43 / /host/run/wrappers rw,nodev,relatime master:93 - tmpfs tmpfs rw,mode=755
+401 397 0:61 / /host/run/credentials/getty@tty1.service ro,nosuid,nodev,noexec,relatime,nosymfollow master:240 - tmpfs tmpfs rw,size=1024k,nr_inodes=1024,mode=700,noswap
+402 397 0:62 / /host/run/credentials/serial-getty@ttyS0.service ro,nosuid,nodev,noexec,relatime,nosymfollow master:288 - tmpfs tmpfs rw,size=1024k,nr_inodes=1024,mode=700,noswap
+403 397 0:63 / /host/run/user/1000 rw,nosuid,nodev,relatime master:295 - tmpfs tmpfs rw,size=401060k,nr_inodes=100265,mode=700,uid=1000,gid=100
+404 254 0:46 / /host/mnt/cwd rw,relatime master:96 - overlay overlay rw,lowerdir=/mnt/.ro-cwd,upperdir=/tmp/.cwd/upper,workdir=/tmp/.cwd/work
+405 254 0:47 / /host/mnt/src rw,relatime master:99 - overlay overlay rw,lowerdir=/nix/store/ihcrl3zwvp2002xyylri2wz0drwajx4z-ns0pa7q2b1jpx9pbf1l9352x6rniwxjn-source,upperdir=/tmp/.src/upper,workdir=/tmp/.src/work
+407 253 0:65 / / rw,nosuid,nodev,relatime - tmpfs rootfs rw,uid=1000000,gid=1000000
+408 407 0:65 /sysroot /sysroot rw,nosuid,nodev,relatime - tmpfs rootfs rw,uid=1000000,gid=1000000
+409 408 253:0 /bin /sysroot/bin rw,nosuid,nodev,relatime master:1 - ext4 /dev/disk/by-label/nixos rw
+410 408 253:0 /home /sysroot/home rw,nosuid,nodev,relatime master:1 - ext4 /dev/disk/by-label/nixos rw
+411 408 253:0 /lib64 /sysroot/lib64 rw,nosuid,nodev,relatime master:1 - ext4 /dev/disk/by-label/nixos rw
+412 408 253:0 /lost+found /sysroot/lost+found rw,nosuid,nodev,relatime master:1 - ext4 /dev/disk/by-label/nixos rw
+413 408 253:0 /nix /sysroot/nix rw,relatime master:1 - ext4 /dev/disk/by-label/nixos rw
+414 413 0:29 / /sysroot/nix/.ro-store rw,relatime master:3 - 9p nix-store rw,cache=f,access=client,msize=16384,trans=virtio
+415 413 0:30 / /sysroot/nix/store rw,relatime master:4 - overlay overlay rw,lowerdir=/mnt-root/nix/.ro-store,upperdir=/mnt-root/nix/.rw-store/upper,workdir=/mnt-root/nix/.rw-store/work
+416 415 0:30 / /sysroot/nix/store ro,relatime master:5 - overlay overlay rw,lowerdir=/mnt-root/nix/.ro-store,upperdir=/mnt-root/nix/.rw-store/upper,workdir=/mnt-root/nix/.rw-store/work`
+
+	checkSimple(t, "remount", []simpleTestCase{
+		{"evalSymlinks", func(k syscallDispatcher) error {
+			return newProcPaths(k, hostPath).remount("/sysroot/nix", syscall.MS_REC|syscall.MS_RDONLY|syscall.MS_NODEV)
+		}, stub.Expect{Calls: []stub.Call{
+			call("evalSymlinks", stub.ExpectArgs{"/sysroot/nix"}, "/sysroot/nix", stub.UniqueError(6)),
+		}}, stub.UniqueError(6)},
+
+		{"open", func(k syscallDispatcher) error {
+			return newProcPaths(k, hostPath).remount("/sysroot/nix", syscall.MS_REC|syscall.MS_RDONLY|syscall.MS_NODEV)
+		}, stub.Expect{Calls: []stub.Call{
+			call("evalSymlinks", stub.ExpectArgs{"/sysroot/nix"}, "/sysroot/nix", nil),
+			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdeadbeef, stub.UniqueError(5)),
+		}}, &os.PathError{Op: "open", Path: "/sysroot/nix", Err: stub.UniqueError(5)}},
+
+		{"readlink", func(k syscallDispatcher) error {
+			return newProcPaths(k, hostPath).remount("/sysroot/nix", syscall.MS_REC|syscall.MS_RDONLY|syscall.MS_NODEV)
+		}, stub.Expect{Calls: []stub.Call{
+			call("evalSymlinks", stub.ExpectArgs{"/sysroot/nix"}, "/sysroot/nix", nil),
+			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdeadbeef, nil),
+			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/3735928559"}, "/sysroot/nix", stub.UniqueError(4)),
+		}}, stub.UniqueError(4)},
+
+		{"close", func(k syscallDispatcher) error {
+			return newProcPaths(k, hostPath).remount("/sysroot/nix", syscall.MS_REC|syscall.MS_RDONLY|syscall.MS_NODEV)
+		}, stub.Expect{Calls: []stub.Call{
+			call("evalSymlinks", stub.ExpectArgs{"/sysroot/nix"}, "/sysroot/nix", nil),
+			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdeadbeef, nil),
+			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/3735928559"}, "/sysroot/nix", nil),
+			call("close", stub.ExpectArgs{0xdeadbeef}, nil, stub.UniqueError(3)),
+		}}, &os.PathError{Op: "close", Path: "/sysroot/nix", Err: stub.UniqueError(3)}},
+
+		{"mountinfo no match", func(k syscallDispatcher) error {
+			return newProcPaths(k, hostPath).remount("/sysroot/nix", syscall.MS_REC|syscall.MS_RDONLY|syscall.MS_NODEV)
+		}, stub.Expect{Calls: []stub.Call{
+			call("evalSymlinks", stub.ExpectArgs{"/sysroot/nix"}, "/sysroot/.hakurei", nil),
+			call("verbosef", stub.ExpectArgs{"target resolves to %q", []any{"/sysroot/.hakurei"}}, nil, nil),
+			call("open", stub.ExpectArgs{"/sysroot/.hakurei", 0x280000, uint32(0)}, 0xdeadbeef, nil),
+			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/3735928559"}, "/sysroot/.hakurei", nil),
+			call("close", stub.ExpectArgs{0xdeadbeef}, nil, nil),
+			call("openNew", stub.ExpectArgs{"/host/proc/self/mountinfo"}, newConstFile(sampleMountinfoNix), nil),
+		}}, &vfs.DecoderError{Op: "unfold", Line: -1, Err: vfs.UnfoldTargetError("/sysroot/.hakurei")}},
+
+		{"mountinfo", func(k syscallDispatcher) error {
+			return newProcPaths(k, hostPath).remount("/sysroot/nix", syscall.MS_REC|syscall.MS_RDONLY|syscall.MS_NODEV)
+		}, stub.Expect{Calls: []stub.Call{
+			call("evalSymlinks", stub.ExpectArgs{"/sysroot/nix"}, "/sysroot/nix", nil),
+			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdeadbeef, nil),
+			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/3735928559"}, "/sysroot/nix", nil),
+			call("close", stub.ExpectArgs{0xdeadbeef}, nil, nil),
+			call("openNew", stub.ExpectArgs{"/host/proc/self/mountinfo"}, newConstFile("\x00"), nil),
+		}}, &vfs.DecoderError{Op: "parse", Line: 0, Err: vfs.ErrMountInfoFields}},
+
+		{"mount", func(k syscallDispatcher) error {
+			return newProcPaths(k, hostPath).remount("/sysroot/nix", syscall.MS_REC|syscall.MS_RDONLY|syscall.MS_NODEV)
+		}, stub.Expect{Calls: []stub.Call{
+			call("evalSymlinks", stub.ExpectArgs{"/sysroot/nix"}, "/sysroot/nix", nil),
+			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdeadbeef, nil),
+			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/3735928559"}, "/sysroot/nix", nil),
+			call("close", stub.ExpectArgs{0xdeadbeef}, nil, nil),
+			call("openNew", stub.ExpectArgs{"/host/proc/self/mountinfo"}, newConstFile(sampleMountinfoNix), nil),
+			call("mount", stub.ExpectArgs{"none", "/sysroot/nix", "", uintptr(0x209027), ""}, nil, stub.UniqueError(2)),
+		}}, stub.UniqueError(2)},
+
+		{"mount propagate", func(k syscallDispatcher) error {
+			return newProcPaths(k, hostPath).remount("/sysroot/nix", syscall.MS_REC|syscall.MS_RDONLY|syscall.MS_NODEV)
+		}, stub.Expect{Calls: []stub.Call{
+			call("evalSymlinks", stub.ExpectArgs{"/sysroot/nix"}, "/sysroot/nix", nil),
+			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdeadbeef, nil),
+			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/3735928559"}, "/sysroot/nix", nil),
+			call("close", stub.ExpectArgs{0xdeadbeef}, nil, nil),
+			call("openNew", stub.ExpectArgs{"/host/proc/self/mountinfo"}, newConstFile(sampleMountinfoNix), nil),
+			call("mount", stub.ExpectArgs{"none", "/sysroot/nix", "", uintptr(0x209027), ""}, nil, nil),
+			call("mount", stub.ExpectArgs{"none", "/sysroot/nix/.ro-store", "", uintptr(0x209027), ""}, nil, stub.UniqueError(1)),
+		}}, stub.UniqueError(1)},
+
+		{"success toplevel", func(k syscallDispatcher) error {
+			return newProcPaths(k, hostPath).remount("/sysroot/bin", syscall.MS_REC|syscall.MS_RDONLY|syscall.MS_NODEV)
+		}, stub.Expect{Calls: []stub.Call{
+			call("evalSymlinks", stub.ExpectArgs{"/sysroot/bin"}, "/sysroot/bin", nil),
+			call("open", stub.ExpectArgs{"/sysroot/bin", 0x280000, uint32(0)}, 0xbabe, nil),
+			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/47806"}, "/sysroot/bin", nil),
+			call("close", stub.ExpectArgs{0xbabe}, nil, nil),
+			call("openNew", stub.ExpectArgs{"/host/proc/self/mountinfo"}, newConstFile(sampleMountinfoNix), nil),
+			call("mount", stub.ExpectArgs{"none", "/sysroot/bin", "", uintptr(0x209027), ""}, nil, nil),
+		}}, nil},
+
+		{"success EACCES", func(k syscallDispatcher) error {
+			return newProcPaths(k, hostPath).remount("/sysroot/nix", syscall.MS_REC|syscall.MS_RDONLY|syscall.MS_NODEV)
+		}, stub.Expect{Calls: []stub.Call{
+			call("evalSymlinks", stub.ExpectArgs{"/sysroot/nix"}, "/sysroot/nix", nil),
+			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdeadbeef, nil),
+			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/3735928559"}, "/sysroot/nix", nil),
+			call("close", stub.ExpectArgs{0xdeadbeef}, nil, nil),
+			call("openNew", stub.ExpectArgs{"/host/proc/self/mountinfo"}, newConstFile(sampleMountinfoNix), nil),
+			call("mount", stub.ExpectArgs{"none", "/sysroot/nix", "", uintptr(0x209027), ""}, nil, nil),
+			call("mount", stub.ExpectArgs{"none", "/sysroot/nix/.ro-store", "", uintptr(0x209027), ""}, nil, syscall.EACCES),
+			call("mount", stub.ExpectArgs{"none", "/sysroot/nix/store", "", uintptr(0x209027), ""}, nil, nil),
+		}}, nil},
+
+		{"success no propagate", func(k syscallDispatcher) error {
+			return newProcPaths(k, hostPath).remount("/sysroot/nix", syscall.MS_RDONLY|syscall.MS_NODEV)
+		}, stub.Expect{Calls: []stub.Call{
+			call("evalSymlinks", stub.ExpectArgs{"/sysroot/nix"}, "/sysroot/nix", nil),
+			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdeadbeef, nil),
+			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/3735928559"}, "/sysroot/nix", nil),
+			call("close", stub.ExpectArgs{0xdeadbeef}, nil, nil),
+			call("openNew", stub.ExpectArgs{"/host/proc/self/mountinfo"}, newConstFile(sampleMountinfoNix), nil),
+			call("mount", stub.ExpectArgs{"none", "/sysroot/nix", "", uintptr(0x209027), ""}, nil, nil),
+		}}, nil},
+
+		{"success case sensitive", func(k syscallDispatcher) error {
+			return newProcPaths(k, hostPath).remount("/sysroot/nix", syscall.MS_REC|syscall.MS_RDONLY|syscall.MS_NODEV)
+		}, stub.Expect{Calls: []stub.Call{
+			call("evalSymlinks", stub.ExpectArgs{"/sysroot/nix"}, "/sysroot/nix", nil),
+			call("open", stub.ExpectArgs{"/sysroot/nix", 0x280000, uint32(0)}, 0xdeadbeef, nil),
+			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/3735928559"}, "/sysroot/nix", nil),
+			call("close", stub.ExpectArgs{0xdeadbeef}, nil, nil),
+			call("openNew", stub.ExpectArgs{"/host/proc/self/mountinfo"}, newConstFile(sampleMountinfoNix), nil),
+			call("mount", stub.ExpectArgs{"none", "/sysroot/nix", "", uintptr(0x209027), ""}, nil, nil),
+			call("mount", stub.ExpectArgs{"none", "/sysroot/nix/.ro-store", "", uintptr(0x209027), ""}, nil, nil),
+			call("mount", stub.ExpectArgs{"none", "/sysroot/nix/store", "", uintptr(0x209027), ""}, nil, nil),
+		}}, nil},
+
+		{"success", func(k syscallDispatcher) error {
+			return newProcPaths(k, hostPath).remount("/sysroot/.nix", syscall.MS_REC|syscall.MS_RDONLY|syscall.MS_NODEV)
+		}, stub.Expect{Calls: []stub.Call{
+			call("evalSymlinks", stub.ExpectArgs{"/sysroot/.nix"}, "/sysroot/NIX", nil),
+			call("verbosef", stub.ExpectArgs{"target resolves to %q", []any{"/sysroot/NIX"}}, nil, nil),
+			call("open", stub.ExpectArgs{"/sysroot/NIX", 0x280000, uint32(0)}, 0xdeadbeef, nil),
+			call("readlink", stub.ExpectArgs{"/host/proc/self/fd/3735928559"}, "/sysroot/nix", nil),
+			call("close", stub.ExpectArgs{0xdeadbeef}, nil, nil),
+			call("openNew", stub.ExpectArgs{"/host/proc/self/mountinfo"}, newConstFile(sampleMountinfoNix), nil),
+			call("mount", stub.ExpectArgs{"none", "/sysroot/nix", "", uintptr(0x209027), ""}, nil, nil),
+			call("mount", stub.ExpectArgs{"none", "/sysroot/nix/.ro-store", "", uintptr(0x209027), ""}, nil, nil),
+			call("mount", stub.ExpectArgs{"none", "/sysroot/nix/store", "", uintptr(0x209027), ""}, nil, nil),
+		}}, nil},
+	})
+}
+
+func TestRemountWithFlags(t *testing.T) {
+	checkSimple(t, "remountWithFlags", []simpleTestCase{
+		{"noop unmatched", func(k syscallDispatcher) error {
+			return remountWithFlags(k, &vfs.MountInfoNode{MountInfoEntry: &vfs.MountInfoEntry{VfsOptstr: "rw,relatime,cat"}}, 0)
+		}, stub.Expect{Calls: []stub.Call{
+			call("verbosef", stub.ExpectArgs{"unmatched vfs options: %q", []any{[]string{"cat"}}}, nil, nil),
+		}}, nil},
+
+		{"noop", func(k syscallDispatcher) error {
+			return remountWithFlags(k, &vfs.MountInfoNode{MountInfoEntry: &vfs.MountInfoEntry{VfsOptstr: "rw,relatime"}}, 0)
+		}, stub.Expect{}, nil},
+
+		{"success", func(k syscallDispatcher) error {
+			return remountWithFlags(k, &vfs.MountInfoNode{MountInfoEntry: &vfs.MountInfoEntry{VfsOptstr: "rw,relatime"}}, syscall.MS_RDONLY)
+		}, stub.Expect{Calls: []stub.Call{
+			call("mount", stub.ExpectArgs{"none", "", "", uintptr(0x209021), ""}, nil, nil),
+		}}, nil},
+	})
+}
+
+func TestMountTmpfs(t *testing.T) {
+	checkSimple(t, "mountTmpfs", []simpleTestCase{
+		{"mkdirAll", func(k syscallDispatcher) error {
+			return mountTmpfs(k, "ephemeral", "/sysroot/run/user/1000", 0, 1<<10, 0700)
+		}, stub.Expect{Calls: []stub.Call{
+			call("mkdirAll", stub.ExpectArgs{"/sysroot/run/user/1000", os.FileMode(0700)}, nil, stub.UniqueError(0)),
+		}}, stub.UniqueError(0)},
+
+		{"success no size", func(k syscallDispatcher) error {
+			return mountTmpfs(k, "ephemeral", "/sysroot/run/user/1000", 0, 0, 0710)
+		}, stub.Expect{Calls: []stub.Call{
+			call("mkdirAll", stub.ExpectArgs{"/sysroot/run/user/1000", os.FileMode(0750)}, nil, nil),
+			call("mount", stub.ExpectArgs{"ephemeral", "/sysroot/run/user/1000", "tmpfs", uintptr(0), "mode=0710"}, nil, nil),
+		}}, nil},
+
+		{"success", func(k syscallDispatcher) error {
+			return mountTmpfs(k, "ephemeral", "/sysroot/run/user/1000", 0, 1<<10, 0700)
+		}, stub.Expect{Calls: []stub.Call{
+			call("mkdirAll", stub.ExpectArgs{"/sysroot/run/user/1000", os.FileMode(0700)}, nil, nil),
+			call("mount", stub.ExpectArgs{"ephemeral", "/sysroot/run/user/1000", "tmpfs", uintptr(0), "mode=0700,size=1024"}, nil, nil),
+		}}, nil},
+	})
+}
+
+func TestParentPerm(t *testing.T) {
+	testCases := []struct {
+		perm os.FileMode
+		want os.FileMode
+	}{
+		{0755, 0755},
+		{0750, 0750},
+		{0705, 0705},
+		{0700, 0700},
+		{050, 0750},
+		{05, 0705},
+		{0, 0700},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.perm.String(), func(t *testing.T) {
+			if got := parentPerm(tc.perm); got != tc.want {
+				t.Errorf("parentPerm: %#o, want %#o", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestEscapeOverlayDataSegment(t *testing.T) {
+	testCases := []struct {
+		name string
+		s    string
+		want string
+	}{
+		{"zero", zeroString, zeroString},
+		{"multi", `\\\:,:,\\\`, `\\\\\\\:\,\:\,\\\\\\`},
+		{"bwrap", `/path :,\`, `/path \:\,\\`},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := EscapeOverlayDataSegment(tc.s); got != tc.want {
+				t.Errorf("escapeOverlayDataSegment: %s, want %s", got, tc.want)
+			}
+		})
+	}
+}

container/msg.go

@@ -1,20 +1,35 @@
 package container
 
 import (
+	"errors"
 	"log"
 	"sync/atomic"
 )
 
+// MessageError is an error with a user-facing message.
+type MessageError interface {
+	// Message returns a user-facing error message.
+	Message() string
+
+	error
+}
+
+// GetErrorMessage returns whether an error implements [MessageError], and the message if it does.
+func GetErrorMessage(err error) (string, bool) {
+	var e MessageError
+	if !errors.As(err, &e) || e == nil {
+		return zeroString, false
+	}
+	return e.Message(), true
+}
+
 type Msg interface {
 	IsVerbose() bool
 	Verbose(v ...any)
 	Verbosef(format string, v ...any)
-	WrapErr(err error, a ...any) error
-	PrintBaseErr(err error, fallback string)
 
 	Suspend()
 	Resume() bool
-
 	BeforeExit()
 }
 
@@ -32,12 +47,21 @@ func (msg *DefaultMsg) Verbosef(format string, v ...any) {
 	}
 }
 
-func (msg *DefaultMsg) WrapErr(err error, a ...any) error {
-	log.Println(a...)
-	return err
-}
-func (msg *DefaultMsg) PrintBaseErr(err error, fallback string) { log.Println(fallback, err) }
-
 func (msg *DefaultMsg) Suspend()     { msg.inactive.Store(true) }
 func (msg *DefaultMsg) Resume() bool { return msg.inactive.CompareAndSwap(true, false) }
 func (msg *DefaultMsg) BeforeExit()  {}
+
+// msg is the [Msg] implemented used by all exported [container] functions.
+var msg Msg = new(DefaultMsg)
+
+// GetOutput returns the current active [Msg] implementation.
+func GetOutput() Msg { return msg }
+
+// SetOutput replaces the current active [Msg] implementation.
+func SetOutput(v Msg) {
+	if v == nil {
+		msg = new(DefaultMsg)
+	} else {
+		msg = v
+	}
+}

container/msg_test.go

@@ -0,0 +1,184 @@
+package container_test
+
+import (
+	"errors"
+	"log"
+	"strings"
+	"sync/atomic"
+	"syscall"
+	"testing"
+
+	"hakurei.app/container"
+)
+
+func TestMessageError(t *testing.T) {
+	testCases := []struct {
+		name   string
+		err    error
+		want   string
+		wantOk bool
+	}{
+		{"nil", nil, "", false},
+		{"new", errors.New(":3"), "", false},
+		{"start", &container.StartError{
+			Step: "meow",
+			Err:  syscall.ENOTRECOVERABLE,
+		}, "cannot meow: state not recoverable", true},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			got, ok := container.GetErrorMessage(tc.err)
+			if got != tc.want {
+				t.Errorf("GetErrorMessage: %q, want %q", got, tc.want)
+			}
+			if ok != tc.wantOk {
+				t.Errorf("GetErrorMessage: ok = %v, want %v", ok, tc.wantOk)
+			}
+		})
+	}
+}
+
+func TestDefaultMsg(t *testing.T) {
+	{
+		w := log.Writer()
+		f := log.Flags()
+		t.Cleanup(func() { log.SetOutput(w); log.SetFlags(f) })
+	}
+	msg := new(container.DefaultMsg)
+
+	t.Run("is verbose", func(t *testing.T) {
+		if !msg.IsVerbose() {
+			t.Error("IsVerbose unexpected outcome")
+		}
+	})
+
+	t.Run("verbose", func(t *testing.T) {
+		log.SetOutput(panicWriter{})
+		msg.Suspend()
+		msg.Verbose()
+		msg.Verbosef("\x00")
+		msg.Resume()
+
+		buf := new(strings.Builder)
+		log.SetOutput(buf)
+		log.SetFlags(0)
+		msg.Verbose()
+		msg.Verbosef("\x00")
+
+		want := "\n\x00\n"
+		if buf.String() != want {
+			t.Errorf("Verbose: %q, want %q", buf.String(), want)
+		}
+	})
+
+	t.Run("inactive", func(t *testing.T) {
+		{
+			inactive := msg.Resume()
+			if inactive {
+				t.Cleanup(func() { msg.Suspend() })
+			}
+		}
+
+		if msg.Resume() {
+			t.Error("Resume unexpected outcome")
+		}
+
+		msg.Suspend()
+		if !msg.Resume() {
+			t.Error("Resume unexpected outcome")
+		}
+	})
+
+	// the function is a noop
+	t.Run("beforeExit", func(t *testing.T) { msg.BeforeExit() })
+}
+
+type panicWriter struct{}
+
+func (panicWriter) Write([]byte) (int, error) { panic("unreachable") }
+
+func saveRestoreOutput(t *testing.T) {
+	out := container.GetOutput()
+	t.Cleanup(func() { container.SetOutput(out) })
+}
+
+func replaceOutput(t *testing.T) {
+	saveRestoreOutput(t)
+	container.SetOutput(&testOutput{t: t})
+}
+
+type testOutput struct {
+	t         *testing.T
+	suspended atomic.Bool
+}
+
+func (out *testOutput) IsVerbose() bool { return testing.Verbose() }
+
+func (out *testOutput) Verbose(v ...any) {
+	if !out.IsVerbose() {
+		return
+	}
+	out.t.Log(v...)
+}
+
+func (out *testOutput) Verbosef(format string, v ...any) {
+	if !out.IsVerbose() {
+		return
+	}
+	out.t.Logf(format, v...)
+}
+
+func (out *testOutput) Suspend() {
+	if out.suspended.CompareAndSwap(false, true) {
+		out.Verbose("suspend called")
+		return
+	}
+	out.Verbose("suspend called on suspended output")
+}
+
+func (out *testOutput) Resume() bool {
+	if out.suspended.CompareAndSwap(true, false) {
+		out.Verbose("resume called")
+		return true
+	}
+	out.Verbose("resume called on unsuspended output")
+	return false
+}
+
+func (out *testOutput) BeforeExit() { out.Verbose("beforeExit called") }
+
+func TestGetSetOutput(t *testing.T) {
+	{
+		out := container.GetOutput()
+		t.Cleanup(func() { container.SetOutput(out) })
+	}
+
+	t.Run("default", func(t *testing.T) {
+		container.SetOutput(new(stubOutput))
+		if v, ok := container.GetOutput().(*container.DefaultMsg); ok {
+			t.Fatalf("SetOutput: got unexpected output %#v", v)
+		}
+		container.SetOutput(nil)
+		if _, ok := container.GetOutput().(*container.DefaultMsg); !ok {
+			t.Fatalf("SetOutput: got unexpected output %#v", container.GetOutput())
+		}
+	})
+
+	t.Run("stub", func(t *testing.T) {
+		container.SetOutput(new(stubOutput))
+		if _, ok := container.GetOutput().(*stubOutput); !ok {
+			t.Fatalf("SetOutput: got unexpected output %#v", container.GetOutput())
+		}
+	})
+}
+
+type stubOutput struct {
+	wrapF func(error, ...any) error
+}
+
+func (*stubOutput) IsVerbose() bool         { panic("unreachable") }
+func (*stubOutput) Verbose(...any)          { panic("unreachable") }
+func (*stubOutput) Verbosef(string, ...any) { panic("unreachable") }
+func (*stubOutput) Suspend()                { panic("unreachable") }
+func (*stubOutput) Resume() bool            { panic("unreachable") }
+func (*stubOutput) BeforeExit()             { panic("unreachable") }

container/ops.go

@@ -1,482 +0,0 @@
-package container
-
-import (
-	"encoding/gob"
-	"fmt"
-	"math"
-	"os"
-	"path"
-	"path/filepath"
-	"slices"
-	"strings"
-	. "syscall"
-	"unsafe"
-)
-
-type (
-	Ops []Op
-	Op  interface {
-		// early is called in host root.
-		early(params *Params) error
-		// apply is called in intermediate root.
-		apply(params *Params) error
-
-		prefix() string
-		Is(op Op) bool
-		fmt.Stringer
-	}
-)
-
-func (f *Ops) Grow(n int) { *f = slices.Grow(*f, n) }
-
-func init() { gob.Register(new(BindMountOp)) }
-
-// BindMountOp bind mounts host path Source on container path Target.
-type BindMountOp struct {
-	Source, SourceFinal, Target string
-
-	Flags int
-}
-
-const (
-	BindOptional = 1 << iota
-	BindWritable
-	BindDevice
-)
-
-func (b *BindMountOp) early(*Params) error {
-	if !path.IsAbs(b.Source) {
-		return msg.WrapErr(EBADE, fmt.Sprintf("path %q is not absolute", b.Source))
-	}
-
-	if v, err := filepath.EvalSymlinks(b.Source); err != nil {
-		if os.IsNotExist(err) && b.Flags&BindOptional != 0 {
-			b.SourceFinal = "\x00"
-			return nil
-		}
-		return wrapErrSelf(err)
-	} else {
-		b.SourceFinal = v
-		return nil
-	}
-}
-
-func (b *BindMountOp) apply(*Params) error {
-	if b.SourceFinal == "\x00" {
-		if b.Flags&BindOptional == 0 {
-			// unreachable
-			return EBADE
-		}
-		return nil
-	}
-
-	if !path.IsAbs(b.SourceFinal) || !path.IsAbs(b.Target) {
-		return msg.WrapErr(EBADE, "path is not absolute")
-	}
-
-	source := toHost(b.SourceFinal)
-	target := toSysroot(b.Target)
-
-	// this perm value emulates bwrap behaviour as it clears bits from 0755 based on
-	// op->perms which is never set for any bind setup op so always results in 0700
-	if fi, err := os.Stat(source); err != nil {
-		return wrapErrSelf(err)
-	} else if fi.IsDir() {
-		if err = os.MkdirAll(target, 0700); err != nil {
-			return wrapErrSelf(err)
-		}
-	} else if err = ensureFile(target, 0444, 0700); err != nil {
-		return err
-	}
-
-	var flags uintptr = MS_REC
-	if b.Flags&BindWritable == 0 {
-		flags |= MS_RDONLY
-	}
-	if b.Flags&BindDevice == 0 {
-		flags |= MS_NODEV
-	}
-
-	return hostProc.bindMount(source, target, flags, b.SourceFinal == b.Target)
-}
-
-func (b *BindMountOp) Is(op Op) bool { vb, ok := op.(*BindMountOp); return ok && *b == *vb }
-func (*BindMountOp) prefix() string  { return "mounting" }
-func (b *BindMountOp) String() string {
-	if b.Source == b.Target {
-		return fmt.Sprintf("%q flags %#x", b.Source, b.Flags)
-	}
-	return fmt.Sprintf("%q on %q flags %#x", b.Source, b.Target, b.Flags&BindWritable)
-}
-func (f *Ops) Bind(source, target string, flags int) *Ops {
-	*f = append(*f, &BindMountOp{source, "", target, flags})
-	return f
-}
-
-func init() { gob.Register(new(MountProcOp)) }
-
-// MountProcOp mounts a private instance of proc.
-type MountProcOp string
-
-func (p MountProcOp) early(*Params) error { return nil }
-func (p MountProcOp) apply(params *Params) error {
-	v := string(p)
-
-	if !path.IsAbs(v) {
-		return msg.WrapErr(EBADE, fmt.Sprintf("path %q is not absolute", v))
-	}
-
-	target := toSysroot(v)
-	if err := os.MkdirAll(target, params.ParentPerm); err != nil {
-		return wrapErrSelf(err)
-	}
-	return wrapErrSuffix(Mount("proc", target, "proc", MS_NOSUID|MS_NOEXEC|MS_NODEV, ""),
-		fmt.Sprintf("cannot mount proc on %q:", v))
-}
-
-func (p MountProcOp) Is(op Op) bool  { vp, ok := op.(MountProcOp); return ok && p == vp }
-func (MountProcOp) prefix() string   { return "mounting" }
-func (p MountProcOp) String() string { return fmt.Sprintf("proc on %q", string(p)) }
-func (f *Ops) Proc(dest string) *Ops {
-	*f = append(*f, MountProcOp(dest))
-	return f
-}
-
-func init() { gob.Register(new(MountDevOp)) }
-
-// MountDevOp mounts part of host dev.
-type MountDevOp string
-
-func (d MountDevOp) early(*Params) error { return nil }
-func (d MountDevOp) apply(params *Params) error {
-	v := string(d)
-
-	if !path.IsAbs(v) {
-		return msg.WrapErr(EBADE, fmt.Sprintf("path %q is not absolute", v))
-	}
-	target := toSysroot(v)
-
-	if err := mountTmpfs("devtmpfs", v, 0, params.ParentPerm); err != nil {
-		return err
-	}
-
-	for _, name := range []string{"null", "zero", "full", "random", "urandom", "tty"} {
-		targetPath := toSysroot(path.Join(v, name))
-		if err := ensureFile(targetPath, 0444, params.ParentPerm); err != nil {
-			return err
-		}
-		if err := hostProc.bindMount(
-			toHost("/dev/"+name),
-			targetPath,
-			0,
-			true,
-		); err != nil {
-			return err
-		}
-	}
-	for i, name := range []string{"stdin", "stdout", "stderr"} {
-		if err := os.Symlink(
-			"/proc/self/fd/"+string(rune(i+'0')),
-			path.Join(target, name),
-		); err != nil {
-			return wrapErrSelf(err)
-		}
-	}
-	for _, pair := range [][2]string{
-		{"/proc/self/fd", "fd"},
-		{"/proc/kcore", "core"},
-		{"pts/ptmx", "ptmx"},
-	} {
-		if err := os.Symlink(pair[0], path.Join(target, pair[1])); err != nil {
-			return wrapErrSelf(err)
-		}
-	}
-
-	devPtsPath := path.Join(target, "pts")
-	for _, name := range []string{path.Join(target, "shm"), devPtsPath} {
-		if err := os.Mkdir(name, params.ParentPerm); err != nil {
-			return wrapErrSelf(err)
-		}
-	}
-
-	if err := Mount("devpts", devPtsPath, "devpts", MS_NOSUID|MS_NOEXEC,
-		"newinstance,ptmxmode=0666,mode=620"); err != nil {
-		return wrapErrSuffix(err,
-			fmt.Sprintf("cannot mount devpts on %q:", devPtsPath))
-	}
-
-	if params.RetainSession {
-		var buf [8]byte
-		if _, _, errno := Syscall(SYS_IOCTL, 1, TIOCGWINSZ, uintptr(unsafe.Pointer(&buf[0]))); errno == 0 {
-			consolePath := toSysroot(path.Join(v, "console"))
-			if err := ensureFile(consolePath, 0444, params.ParentPerm); err != nil {
-				return err
-			}
-			if name, err := os.Readlink(hostProc.stdout()); err != nil {
-				return wrapErrSelf(err)
-			} else if err = hostProc.bindMount(
-				toHost(name),
-				consolePath,
-				0,
-				false,
-			); err != nil {
-				return err
-			}
-		}
-	}
-
-	return nil
-}
-
-func (d MountDevOp) Is(op Op) bool  { vd, ok := op.(MountDevOp); return ok && d == vd }
-func (MountDevOp) prefix() string   { return "mounting" }
-func (d MountDevOp) String() string { return fmt.Sprintf("dev on %q", string(d)) }
-func (f *Ops) Dev(dest string) *Ops {
-	*f = append(*f, MountDevOp(dest))
-	return f
-}
-
-func init() { gob.Register(new(MountMqueueOp)) }
-
-// MountMqueueOp mounts a private mqueue instance on container Path.
-type MountMqueueOp string
-
-func (m MountMqueueOp) early(*Params) error { return nil }
-func (m MountMqueueOp) apply(params *Params) error {
-	v := string(m)
-
-	if !path.IsAbs(v) {
-		return msg.WrapErr(EBADE, fmt.Sprintf("path %q is not absolute", v))
-	}
-
-	target := toSysroot(v)
-	if err := os.MkdirAll(target, params.ParentPerm); err != nil {
-		return wrapErrSelf(err)
-	}
-	return wrapErrSuffix(Mount("mqueue", target, "mqueue", MS_NOSUID|MS_NOEXEC|MS_NODEV, ""),
-		fmt.Sprintf("cannot mount mqueue on %q:", v))
-}
-
-func (m MountMqueueOp) Is(op Op) bool  { vm, ok := op.(MountMqueueOp); return ok && m == vm }
-func (MountMqueueOp) prefix() string   { return "mounting" }
-func (m MountMqueueOp) String() string { return fmt.Sprintf("mqueue on %q", string(m)) }
-func (f *Ops) Mqueue(dest string) *Ops {
-	*f = append(*f, MountMqueueOp(dest))
-	return f
-}
-
-func init() { gob.Register(new(MountTmpfsOp)) }
-
-// MountTmpfsOp mounts tmpfs on container Path.
-type MountTmpfsOp struct {
-	Path string
-	Size int
-	Perm os.FileMode
-}
-
-func (t *MountTmpfsOp) early(*Params) error { return nil }
-func (t *MountTmpfsOp) apply(*Params) error {
-	if !path.IsAbs(t.Path) {
-		return msg.WrapErr(EBADE, fmt.Sprintf("path %q is not absolute", t.Path))
-	}
-	if t.Size < 0 || t.Size > math.MaxUint>>1 {
-		return msg.WrapErr(EBADE, fmt.Sprintf("size %d out of bounds", t.Size))
-	}
-	return mountTmpfs("tmpfs", t.Path, t.Size, t.Perm)
-}
-
-func (t *MountTmpfsOp) Is(op Op) bool  { vt, ok := op.(*MountTmpfsOp); return ok && *t == *vt }
-func (*MountTmpfsOp) prefix() string   { return "mounting" }
-func (t *MountTmpfsOp) String() string { return fmt.Sprintf("tmpfs on %q size %d", t.Path, t.Size) }
-func (f *Ops) Tmpfs(dest string, size int, perm os.FileMode) *Ops {
-	*f = append(*f, &MountTmpfsOp{dest, size, perm})
-	return f
-}
-
-func init() { gob.Register(new(SymlinkOp)) }
-
-// SymlinkOp creates a symlink in the container filesystem.
-type SymlinkOp [2]string
-
-func (l *SymlinkOp) early(*Params) error {
-	if strings.HasPrefix(l[0], "*") {
-		l[0] = l[0][1:]
-		if !path.IsAbs(l[0]) {
-			return msg.WrapErr(EBADE, fmt.Sprintf("path %q is not absolute", l[0]))
-		}
-		if name, err := os.Readlink(l[0]); err != nil {
-			return wrapErrSelf(err)
-		} else {
-			l[0] = name
-		}
-	}
-	return nil
-}
-func (l *SymlinkOp) apply(params *Params) error {
-	// symlink target is an arbitrary path value, so only validate link name here
-	if !path.IsAbs(l[1]) {
-		return msg.WrapErr(EBADE, fmt.Sprintf("path %q is not absolute", l[1]))
-	}
-
-	target := toSysroot(l[1])
-	if err := os.MkdirAll(path.Dir(target), params.ParentPerm); err != nil {
-		return wrapErrSelf(err)
-	}
-	if err := os.Symlink(l[0], target); err != nil {
-		return wrapErrSelf(err)
-	}
-	return nil
-}
-
-func (l *SymlinkOp) Is(op Op) bool  { vl, ok := op.(*SymlinkOp); return ok && *l == *vl }
-func (*SymlinkOp) prefix() string   { return "creating" }
-func (l *SymlinkOp) String() string { return fmt.Sprintf("symlink on %q target %q", l[1], l[0]) }
-func (f *Ops) Link(target, linkName string) *Ops {
-	*f = append(*f, &SymlinkOp{target, linkName})
-	return f
-}
-
-func init() { gob.Register(new(MkdirOp)) }
-
-// MkdirOp creates a directory in the container filesystem.
-type MkdirOp struct {
-	Path string
-	Perm os.FileMode
-}
-
-func (m *MkdirOp) early(*Params) error { return nil }
-func (m *MkdirOp) apply(*Params) error {
-	if !path.IsAbs(m.Path) {
-		return msg.WrapErr(EBADE, fmt.Sprintf("path %q is not absolute", m.Path))
-	}
-
-	if err := os.MkdirAll(toSysroot(m.Path), m.Perm); err != nil {
-		return wrapErrSelf(err)
-	}
-	return nil
-}
-
-func (m *MkdirOp) Is(op Op) bool  { vm, ok := op.(*MkdirOp); return ok && m == vm }
-func (*MkdirOp) prefix() string   { return "creating" }
-func (m *MkdirOp) String() string { return fmt.Sprintf("directory %q perm %s", m.Path, m.Perm) }
-func (f *Ops) Mkdir(dest string, perm os.FileMode) *Ops {
-	*f = append(*f, &MkdirOp{dest, perm})
-	return f
-}
-
-func init() { gob.Register(new(TmpfileOp)) }
-
-// TmpfileOp places a file in container Path containing Data.
-type TmpfileOp struct {
-	Path string
-	Data []byte
-}
-
-func (t *TmpfileOp) early(*Params) error { return nil }
-func (t *TmpfileOp) apply(params *Params) error {
-	if !path.IsAbs(t.Path) {
-		return msg.WrapErr(EBADE, fmt.Sprintf("path %q is not absolute", t.Path))
-	}
-
-	var tmpPath string
-	if f, err := os.CreateTemp("/", "tmp.*"); err != nil {
-		return wrapErrSelf(err)
-	} else if _, err = f.Write(t.Data); err != nil {
-		return wrapErrSuffix(err,
-			"cannot write to intermediate file:")
-	} else if err = f.Close(); err != nil {
-		return wrapErrSuffix(err,
-			"cannot close intermediate file:")
-	} else {
-		tmpPath = f.Name()
-	}
-
-	target := toSysroot(t.Path)
-	if err := ensureFile(target, 0444, params.ParentPerm); err != nil {
-		return err
-	} else if err = hostProc.bindMount(
-		tmpPath,
-		target,
-		MS_RDONLY|MS_NODEV,
-		false,
-	); err != nil {
-		return err
-	} else if err = os.Remove(tmpPath); err != nil {
-		return wrapErrSelf(err)
-	}
-	return nil
-}
-
-func (t *TmpfileOp) Is(op Op) bool {
-	vt, ok := op.(*TmpfileOp)
-	return ok && t.Path == vt.Path && slices.Equal(t.Data, vt.Data)
-}
-func (*TmpfileOp) prefix() string { return "placing" }
-func (t *TmpfileOp) String() string {
-	return fmt.Sprintf("tmpfile %q (%d bytes)", t.Path, len(t.Data))
-}
-func (f *Ops) Place(name string, data []byte) *Ops { *f = append(*f, &TmpfileOp{name, data}); return f }
-func (f *Ops) PlaceP(name string, dataP **[]byte) *Ops {
-	t := &TmpfileOp{Path: name}
-	*dataP = &t.Data
-
-	*f = append(*f, t)
-	return f
-}
-
-func init() { gob.Register(new(AutoEtcOp)) }
-
-// AutoEtcOp expands host /etc into a toplevel symlink mirror with /etc semantics.
-// This is not a generic setup op. It is implemented here to reduce ipc overhead.
-type AutoEtcOp struct{ Prefix string }
-
-func (e *AutoEtcOp) early(*Params) error { return nil }
-func (e *AutoEtcOp) apply(*Params) error {
-	const target = sysrootPath + "/etc/"
-	rel := e.hostRel() + "/"
-
-	if err := os.MkdirAll(target, 0755); err != nil {
-		return wrapErrSelf(err)
-	}
-	if d, err := os.ReadDir(toSysroot(e.hostPath())); err != nil {
-		return wrapErrSelf(err)
-	} else {
-		for _, ent := range d {
-			n := ent.Name()
-			switch n {
-			case ".host":
-
-			case "passwd":
-			case "group":
-
-			case "mtab":
-				if err = os.Symlink("/proc/mounts", target+n); err != nil {
-					return wrapErrSelf(err)
-				}
-
-			default:
-				if err = os.Symlink(rel+n, target+n); err != nil {
-					return wrapErrSelf(err)
-				}
-			}
-		}
-	}
-
-	return nil
-}
-func (e *AutoEtcOp) hostPath() string { return "/etc/" + e.hostRel() }
-func (e *AutoEtcOp) hostRel() string  { return ".host/" + e.Prefix }
-
-func (e *AutoEtcOp) Is(op Op) bool {
-	ve, ok := op.(*AutoEtcOp)
-	return ok && ((e == nil && ve == nil) || (e != nil && ve != nil && *e == *ve))
-}
-func (*AutoEtcOp) prefix() string   { return "setting up" }
-func (e *AutoEtcOp) String() string { return fmt.Sprintf("auto etc %s", e.Prefix) }
-func (f *Ops) Etc(host, prefix string) *Ops {
-	e := &AutoEtcOp{prefix}
-	f.Mkdir("/etc", 0755)
-	f.Bind(host, e.hostPath(), 0)
-	*f = append(*f, e)
-	return f
-}

container/output.go

@@ -1,26 +1,77 @@
 package container
 
-var msg Msg = new(DefaultMsg)
+import (
+	"bytes"
+	"io"
+	"sync"
+	"sync/atomic"
+	"syscall"
+)
 
-func GetOutput() Msg { return msg }
-func SetOutput(v Msg) {
-	if v == nil {
-		msg = new(DefaultMsg)
-	} else {
-		msg = v
-	}
+const (
+	suspendBufInitial = 1 << 12
+	suspendBufMax     = 1 << 24
+)
+
+// Suspendable proxies writes to a downstream [io.Writer] but optionally withholds writes
+// between calls to Suspend and Resume.
+type Suspendable struct {
+	Downstream io.Writer
+
+	s atomic.Bool
+
+	buf bytes.Buffer
+	// for growing buf
+	bufOnce sync.Once
+	// for synchronising all other buf operations
+	bufMu sync.Mutex
+
+	dropped int
 }
 
-func wrapErrSuffix(err error, a ...any) error {
-	if err == nil {
-		return nil
+func (s *Suspendable) Write(p []byte) (n int, err error) {
+	if !s.s.Load() {
+		return s.Downstream.Write(p)
 	}
-	return msg.WrapErr(err, append(a, err)...)
+	s.bufOnce.Do(func() { s.buf.Grow(suspendBufInitial) })
+
+	s.bufMu.Lock()
+	defer s.bufMu.Unlock()
+
+	if free := suspendBufMax - s.buf.Len(); free < len(p) {
+		// fast path
+		if free <= 0 {
+			s.dropped += len(p)
+			return 0, syscall.ENOMEM
+		}
+
+		n, _ = s.buf.Write(p[:free])
+		err = syscall.ENOMEM
+		s.dropped += len(p) - n
+		return
+	}
+
+	return s.buf.Write(p)
 }
 
-func wrapErrSelf(err error) error {
-	if err == nil {
-		return nil
+// IsSuspended returns whether [Suspendable] is currently between a call to Suspend and Resume.
+func (s *Suspendable) IsSuspended() bool { return s.s.Load() }
+
+// Suspend causes [Suspendable] to start withholding output in its buffer.
+func (s *Suspendable) Suspend() bool { return s.s.CompareAndSwap(false, true) }
+
+// Resume undoes the effect of Suspend and dumps the buffered into the downstream [io.Writer].
+func (s *Suspendable) Resume() (resumed bool, dropped uintptr, n int64, err error) {
+	if s.s.CompareAndSwap(true, false) {
+		s.bufMu.Lock()
+		defer s.bufMu.Unlock()
+
+		resumed = true
+		dropped = uintptr(s.dropped)
+
+		s.dropped = 0
+		n, err = io.Copy(s.Downstream, &s.buf)
+		s.buf.Reset()
 	}
-	return msg.WrapErr(err, err.Error())
+	return
 }

container/output_test.go

@@ -0,0 +1,155 @@
+package container_test
+
+import (
+	"bytes"
+	"errors"
+	"reflect"
+	"strconv"
+	"syscall"
+	"testing"
+
+	"hakurei.app/container"
+	"hakurei.app/container/stub"
+)
+
+func TestSuspendable(t *testing.T) {
+	// copied from output.go
+	const suspendBufMax = 1 << 24
+
+	const (
+		// equivalent to len(want.pt)
+		nSpecialPtEquiv = -iota - 1
+		// equivalent to len(want.w)
+		nSpecialWEquiv
+		// suspends writer before executing test case, implies nSpecialWEquiv
+		nSpecialSuspend
+		// offset: resume writer and measure against dump instead, implies nSpecialPtEquiv
+		nSpecialDump
+	)
+
+	// shares the same writer
+	testCases := []struct {
+		name    string
+		w, pt   []byte
+		err     error
+		wantErr error
+		n       int
+	}{
+		{"simple", []byte{0xde, 0xad, 0xbe, 0xef}, []byte{0xde, 0xad, 0xbe, 0xef},
+			nil, nil, nSpecialPtEquiv},
+
+		{"error", []byte{0xb, 0xad}, []byte{0xb, 0xad},
+			stub.UniqueError(0), stub.UniqueError(0), nSpecialPtEquiv},
+
+		{"suspend short", []byte{0}, nil,
+			nil, nil, nSpecialSuspend},
+		{"sw short 0", []byte{0xca, 0xfe, 0xba, 0xbe}, nil,
+			nil, nil, nSpecialWEquiv},
+		{"sw short 1", []byte{0xff}, nil,
+			nil, nil, nSpecialWEquiv},
+		{"resume short", nil, []byte{0, 0xca, 0xfe, 0xba, 0xbe, 0xff}, nil, nil,
+			nSpecialDump},
+
+		{"long pt", bytes.Repeat([]byte{0xff}, suspendBufMax+1), bytes.Repeat([]byte{0xff}, suspendBufMax+1),
+			nil, nil, nSpecialPtEquiv},
+
+		{"suspend fill", bytes.Repeat([]byte{0xfe}, suspendBufMax), nil,
+			nil, nil, nSpecialSuspend},
+		{"drop", []byte{0}, nil,
+			nil, syscall.ENOMEM, 0},
+		{"drop error", []byte{0}, nil,
+			stub.UniqueError(1), syscall.ENOMEM, 0},
+		{"resume fill", nil, bytes.Repeat([]byte{0xfe}, suspendBufMax),
+			nil, nil, nSpecialDump - 2},
+
+		{"suspend fill partial", bytes.Repeat([]byte{0xfd}, suspendBufMax-0xf), nil,
+			nil, nil, nSpecialSuspend},
+		{"partial write", bytes.Repeat([]byte{0xad}, 0x1f), nil,
+			nil, syscall.ENOMEM, 0xf},
+		{"full drop", []byte{0}, nil,
+			nil, syscall.ENOMEM, 0},
+		{"resume fill partial", nil, append(bytes.Repeat([]byte{0xfd}, suspendBufMax-0xf), bytes.Repeat([]byte{0xad}, 0xf)...),
+			nil, nil, nSpecialDump - 0x10 - 1},
+	}
+
+	var dw expectWriter
+
+	w := container.Suspendable{Downstream: &dw}
+	for _, tc := range testCases {
+		// these share the same writer, so cannot be subtests
+		t.Logf("writing step %q", tc.name)
+		dw.expect, dw.err = tc.pt, tc.err
+
+		var (
+			gotN   int
+			gotErr error
+		)
+
+		wantN := tc.n
+		switch wantN {
+		case nSpecialPtEquiv:
+			wantN = len(tc.pt)
+			gotN, gotErr = w.Write(tc.w)
+
+		case nSpecialWEquiv:
+			wantN = len(tc.w)
+			gotN, gotErr = w.Write(tc.w)
+
+		case nSpecialSuspend:
+			s := w.IsSuspended()
+			if ok := w.Suspend(); s && ok {
+				t.Fatal("Suspend: unexpected success")
+			}
+
+			wantN = len(tc.w)
+			gotN, gotErr = w.Write(tc.w)
+
+		default:
+			if wantN <= nSpecialDump {
+				if !w.IsSuspended() {
+					t.Fatal("IsSuspended unexpected false")
+				}
+
+				resumed, dropped, n, err := w.Resume()
+				if !resumed {
+					t.Fatal("Resume: resumed = false")
+				}
+				if wantDropped := nSpecialDump - wantN; int(dropped) != wantDropped {
+					t.Errorf("Resume: dropped = %d, want %d", dropped, wantDropped)
+				}
+
+				wantN = len(tc.pt)
+				gotN, gotErr = int(n), err
+			} else {
+				gotN, gotErr = w.Write(tc.w)
+			}
+		}
+
+		if gotN != wantN {
+			t.Errorf("Write: n = %d, want %d", gotN, wantN)
+		}
+
+		if !reflect.DeepEqual(gotErr, tc.wantErr) {
+			t.Errorf("Write: %v", gotErr)
+		}
+	}
+}
+
+// expectWriter compares Write calls to expect.
+type expectWriter struct {
+	expect []byte
+	err    error
+}
+
+func (w *expectWriter) Write(p []byte) (n int, err error) {
+	defer func() { w.expect = nil }()
+
+	n, err = len(p), w.err
+	if w.expect == nil {
+		return 0, errors.New("unexpected call to Write: " + strconv.Quote(string(p)))
+	}
+	if string(p) != string(w.expect) {
+		return 0, errors.New("p = " + strconv.Quote(string(p)) + ", want " + strconv.Quote(string(w.expect)))
+	}
+	return
+}

container/params.go

@@ -5,11 +5,7 @@ import (
 	"errors"
 	"os"
 	"strconv"
-)
-
-var (
-	ErrNotSet  = errors.New("environment variable not set")
-	ErrInvalid = errors.New("bad file descriptor")
+	"syscall"
 )
 
 // Setup appends the read end of a pipe for setup params transmission and returns its fd.
@@ -23,22 +19,26 @@ func Setup(extraFiles *[]*os.File) (int, *gob.Encoder, error) {
 	}
 }
 
+var (
+	ErrReceiveEnv = errors.New("environment variable not set")
+)
+
 // Receive retrieves setup fd from the environment and receives params.
-func Receive(key string, e any, v **os.File) (func() error, error) {
+func Receive(key string, e any, fdp *uintptr) (func() error, error) {
 	var setup *os.File
 
 	if s, ok := os.LookupEnv(key); !ok {
-		return nil, ErrNotSet
+		return nil, ErrReceiveEnv
 	} else {
 		if fd, err := strconv.Atoi(s); err != nil {
-			return nil, err
+			return nil, errors.Unwrap(err)
 		} else {
 			setup = os.NewFile(uintptr(fd), "setup")
 			if setup == nil {
-				return nil, ErrInvalid
+				return nil, syscall.EDOM
 			}
-			if v != nil {
-				*v = setup
+			if fdp != nil {
+				*fdp = setup.Fd()
 			}
 		}
 	}

container/params_test.go

@@ -0,0 +1,120 @@
+package container_test
+
+import (
+	"errors"
+	"os"
+	"slices"
+	"strconv"
+	"syscall"
+	"testing"
+
+	"hakurei.app/container"
+)
+
+func TestSetupReceive(t *testing.T) {
+	t.Run("not set", func(t *testing.T) {
+		const key = "TEST_ENV_NOT_SET"
+		{
+			v, ok := os.LookupEnv(key)
+			t.Cleanup(func() {
+				if ok {
+					if err := os.Setenv(key, v); err != nil {
+						t.Fatalf("Setenv: error = %v", err)
+					}
+				} else {
+					if err := os.Unsetenv(key); err != nil {
+						t.Fatalf("Unsetenv: error = %v", err)
+					}
+				}
+			})
+		}
+
+		if _, err := container.Receive(key, nil, nil); !errors.Is(err, container.ErrReceiveEnv) {
+			t.Errorf("Receive: error = %v, want %v", err, container.ErrReceiveEnv)
+		}
+	})
+
+	t.Run("format", func(t *testing.T) {
+		const key = "TEST_ENV_FORMAT"
+		t.Setenv(key, "")
+
+		if _, err := container.Receive(key, nil, nil); !errors.Is(err, strconv.ErrSyntax) {
+			t.Errorf("Receive: error = %v, want %v", err, strconv.ErrSyntax)
+		}
+	})
+
+	t.Run("range", func(t *testing.T) {
+		const key = "TEST_ENV_RANGE"
+		t.Setenv(key, "-1")
+
+		if _, err := container.Receive(key, nil, nil); !errors.Is(err, syscall.EDOM) {
+			t.Errorf("Receive: error = %v, want %v", err, syscall.EDOM)
+		}
+	})
+
+	t.Run("setup receive", func(t *testing.T) {
+		check := func(t *testing.T, useNilFdp bool) {
+			const key = "TEST_SETUP_RECEIVE"
+			payload := []int{syscall.MS_MGC_VAL, syscall.MS_MGC_MSK, syscall.MS_ASYNC, syscall.MS_ACTIVE}
+
+			encoderDone := make(chan error, 1)
+			extraFiles := make([]*os.File, 0, 1)
+			if fd, encoder, err := container.Setup(&extraFiles); err != nil {
+				t.Fatalf("Setup: error = %v", err)
+			} else if fd != 3 {
+				t.Fatalf("Setup: fd = %d, want 3", fd)
+			} else {
+				go func() { encoderDone <- encoder.Encode(payload) }()
+			}
+
+			if len(extraFiles) != 1 {
+				t.Fatalf("extraFiles: len = %v, want 1", len(extraFiles))
+			}
+
+			var dupFd int
+			if fd, err := syscall.Dup(int(extraFiles[0].Fd())); err != nil {
+				t.Fatalf("Dup: error = %v", err)
+			} else {
+				syscall.CloseOnExec(fd)
+				dupFd = fd
+				t.Setenv(key, strconv.Itoa(fd))
+			}
+
+			var (
+				gotPayload []int
+				fdp        *uintptr
+			)
+			if !useNilFdp {
+				fdp = new(uintptr)
+			}
+			var closeFile func() error
+			if f, err := container.Receive(key, &gotPayload, fdp); err != nil {
+				t.Fatalf("Receive: error = %v", err)
+			} else {
+				closeFile = f
+
+				if !slices.Equal(payload, gotPayload) {
+					t.Errorf("Receive: %#v, want %#v", gotPayload, payload)
+				}
+			}
+			if !useNilFdp {
+				if int(*fdp) != dupFd {
+					t.Errorf("Fd: %d, want %d", *fdp, dupFd)
+				}
+			}
+
+			if err := <-encoderDone; err != nil {
+				t.Errorf("Encode: error = %v", err)
+			}
+
+			if closeFile != nil {
+				if err := closeFile(); err != nil {
+					t.Errorf("Close: error = %v", err)
+				}
+			}
+		}
+
+		t.Run("fp", func(t *testing.T) { check(t, false) })
+		t.Run("nil", func(t *testing.T) { check(t, true) })
+	})
+}

container/path.go

@@ -2,7 +2,6 @@ package container
 
 import (
 	"errors"
-	"fmt"
 	"io/fs"
 	"os"
 	"path"
@@ -13,10 +12,81 @@ import (
 	"hakurei.app/container/vfs"
 )
 
+/* constants in this file bypass abs check, be extremely careful when changing them! */
+
 const (
-	hostPath    = "/" + hostDir
+	// FHSRoot points to the file system root.
+	FHSRoot = "/"
+	// FHSEtc points to the directory for system-specific configuration.
+	FHSEtc = "/etc/"
+	// FHSTmp points to the place for small temporary files.
+	FHSTmp = "/tmp/"
+
+	// FHSRun points to a "tmpfs" file system for system packages to place runtime data, socket files, and similar.
+	FHSRun = "/run/"
+	// FHSRunUser points to a directory containing per-user runtime directories,
+	// each usually individually mounted "tmpfs" instances.
+	FHSRunUser = FHSRun + "user/"
+
+	// FHSUsr points to vendor-supplied operating system resources.
+	FHSUsr = "/usr/"
+	// FHSUsrBin points to binaries and executables for user commands that shall appear in the $PATH search path.
+	FHSUsrBin = FHSUsr + "bin/"
+
+	// FHSVar points to persistent, variable system data. Writable during normal system operation.
+	FHSVar = "/var/"
+	// FHSVarLib points to persistent system data.
+	FHSVarLib = FHSVar + "lib/"
+	// FHSVarEmpty points to a nonstandard directory that is usually empty.
+	FHSVarEmpty = FHSVar + "empty/"
+
+	// FHSDev points to the root directory for device nodes.
+	FHSDev = "/dev/"
+	// FHSProc points to a virtual kernel file system exposing the process list and other functionality.
+	FHSProc = "/proc/"
+	// FHSProcSys points to a hierarchy below /proc/ that exposes a number of kernel tunables.
+	FHSProcSys = FHSProc + "sys/"
+	// FHSSys points to a virtual kernel file system exposing discovered devices and other functionality.
+	FHSSys = "/sys/"
+)
+
+var (
+	// AbsFHSRoot is [FHSRoot] as [Absolute].
+	AbsFHSRoot = &Absolute{FHSRoot}
+	// AbsFHSEtc is [FHSEtc] as [Absolute].
+	AbsFHSEtc = &Absolute{FHSEtc}
+	// AbsFHSTmp is [FHSTmp] as [Absolute].
+	AbsFHSTmp = &Absolute{FHSTmp}
+
+	// AbsFHSRun is [FHSRun] as [Absolute].
+	AbsFHSRun = &Absolute{FHSRun}
+	// AbsFHSRunUser is [FHSRunUser] as [Absolute].
+	AbsFHSRunUser = &Absolute{FHSRunUser}
+
+	// AbsFHSUsrBin is [FHSUsrBin] as [Absolute].
+	AbsFHSUsrBin = &Absolute{FHSUsrBin}
+
+	// AbsFHSVar is [FHSVar] as [Absolute].
+	AbsFHSVar = &Absolute{FHSVar}
+	// AbsFHSVarLib is [FHSVarLib] as [Absolute].
+	AbsFHSVarLib = &Absolute{FHSVarLib}
+
+	// AbsFHSDev is [FHSDev] as [Absolute].
+	AbsFHSDev = &Absolute{FHSDev}
+	// AbsFHSProc is [FHSProc] as [Absolute].
+	AbsFHSProc = &Absolute{FHSProc}
+	// AbsFHSSys is [FHSSys] as [Absolute].
+	AbsFHSSys = &Absolute{FHSSys}
+)
+
+const (
+	// Nonexistent is a path that cannot exist.
+	// /proc is chosen because a system with covered /proc is unsupported by this package.
+	Nonexistent = FHSProc + "nonexistent"
+
+	hostPath    = FHSRoot + hostDir
 	hostDir     = "host"
-	sysrootPath = "/" + sysrootDir
+	sysrootPath = FHSRoot + sysrootDir
 	sysrootDir  = "sysroot"
 )
 
@@ -32,17 +102,14 @@ func toHost(name string) string {
 
 func createFile(name string, perm, pperm os.FileMode, content []byte) error {
 	if err := os.MkdirAll(path.Dir(name), pperm); err != nil {
-		return wrapErrSelf(err)
+		return err
 	}
 	f, err := os.OpenFile(name, syscall.O_CREAT|syscall.O_EXCL|syscall.O_WRONLY, perm)
 	if err != nil {
-		return wrapErrSelf(err)
+		return err
 	}
 	if content != nil {
 		_, err = f.Write(content)
-		if err != nil {
-			err = wrapErrSelf(err)
-		}
 	}
 	return errors.Join(f.Close(), err)
 }
@@ -57,19 +124,19 @@ func ensureFile(name string, perm, pperm os.FileMode) error {
 	}
 
 	if mode := fi.Mode(); mode&fs.ModeDir != 0 || mode&fs.ModeSymlink != 0 {
-		err = msg.WrapErr(syscall.EISDIR,
-			fmt.Sprintf("path %q is a directory", name))
+		err = &os.PathError{Op: "ensure", Path: name, Err: syscall.EISDIR}
 	}
 	return err
 }
 
-var hostProc = newProcPats(hostPath)
+var hostProc = newProcPaths(direct{}, hostPath)
 
-func newProcPats(prefix string) *procPaths {
-	return &procPaths{prefix + "/proc", prefix + "/proc/self"}
+func newProcPaths(k syscallDispatcher, prefix string) *procPaths {
+	return &procPaths{k, prefix + "/proc", prefix + "/proc/self"}
 }
 
 type procPaths struct {
+	k      syscallDispatcher
 	prefix string
 	self   string
 }
@@ -77,17 +144,15 @@ type procPaths struct {
 func (p *procPaths) stdout() string   { return p.self + "/fd/1" }
 func (p *procPaths) fd(fd int) string { return p.self + "/fd/" + strconv.Itoa(fd) }
 func (p *procPaths) mountinfo(f func(d *vfs.MountInfoDecoder) error) error {
-	if r, err := os.Open(p.self + "/mountinfo"); err != nil {
-		return wrapErrSelf(err)
+	if r, err := p.k.openNew(p.self + "/mountinfo"); err != nil {
+		return err
 	} else {
 		d := vfs.NewMountInfoDecoder(r)
 		err0 := f(d)
 		if err = r.Close(); err != nil {
-			return wrapErrSuffix(err,
-				"cannot close mountinfo:")
+			return err
 		} else if err = d.Err(); err != nil {
-			return wrapErrSuffix(err,
-				"cannot parse mountinfo:")
+			return err
 		}
 		return err0
 	}

container/path_test.go

@@ -0,0 +1,257 @@
+package container
+
+import (
+	"io"
+	"math"
+	"os"
+	"path"
+	"reflect"
+	"syscall"
+	"testing"
+	"unsafe"
+
+	"hakurei.app/container/vfs"
+)
+
+func TestToSysroot(t *testing.T) {
+	testCases := []struct {
+		name string
+		want string
+	}{
+		{"", "/sysroot"},
+		{"/", "/sysroot"},
+		{"//etc///", "/sysroot/etc"},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := toSysroot(tc.name); got != tc.want {
+				t.Errorf("toSysroot: %q, want %q", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestToHost(t *testing.T) {
+	testCases := []struct {
+		name string
+		want string
+	}{
+		{"", "/host"},
+		{"/", "/host"},
+		{"//etc///", "/host/etc"},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := toHost(tc.name); got != tc.want {
+				t.Errorf("toHost: %q, want %q", got, tc.want)
+			}
+		})
+	}
+}
+
+// InternalToHostOvlEscape exports toHost passed to EscapeOverlayDataSegment.
+func InternalToHostOvlEscape(s string) string { return EscapeOverlayDataSegment(toHost(s)) }
+
+func TestCreateFile(t *testing.T) {
+	t.Run("nonexistent", func(t *testing.T) {
+		t.Run("mkdir", func(t *testing.T) {
+			wantErr := &os.PathError{
+				Op:   "mkdir",
+				Path: "/proc/nonexistent",
+				Err:  syscall.ENOENT,
+			}
+			if err := createFile(path.Join(Nonexistent, ":3"), 0644, 0755, nil); !reflect.DeepEqual(err, wantErr) {
+				t.Errorf("createFile: error = %#v, want %#v", err, wantErr)
+			}
+		})
+
+		t.Run("open", func(t *testing.T) {
+			wantErr := &os.PathError{
+				Op:   "open",
+				Path: "/proc/nonexistent",
+				Err:  syscall.ENOENT,
+			}
+			if err := createFile(path.Join(Nonexistent), 0644, 0755, nil); !reflect.DeepEqual(err, wantErr) {
+				t.Errorf("createFile: error = %#v, want %#v", err, wantErr)
+			}
+		})
+	})
+
+	t.Run("touch", func(t *testing.T) {
+		tempDir := t.TempDir()
+		pathname := path.Join(tempDir, "empty")
+		if err := createFile(pathname, 0644, 0755, nil); err != nil {
+			t.Fatalf("createFile: error = %v", err)
+		}
+		if d, err := os.ReadFile(pathname); err != nil {
+			t.Fatalf("ReadFile: error = %v", err)
+		} else if len(d) != 0 {
+			t.Fatalf("createFile: %q", string(d))
+		}
+	})
+
+	t.Run("write", func(t *testing.T) {
+		tempDir := t.TempDir()
+		pathname := path.Join(tempDir, "zero")
+		if err := createFile(pathname, 0644, 0755, []byte{0}); err != nil {
+			t.Fatalf("createFile: error = %v", err)
+		}
+		if d, err := os.ReadFile(pathname); err != nil {
+			t.Fatalf("ReadFile: error = %v", err)
+		} else if string(d) != "\x00" {
+			t.Fatalf("createFile: %q, want %q", string(d), "\x00")
+		}
+	})
+}
+
+func TestEnsureFile(t *testing.T) {
+	t.Run("create", func(t *testing.T) {
+		if err := ensureFile(path.Join(t.TempDir(), "ensure"), 0644, 0755); err != nil {
+			t.Errorf("ensureFile: error = %v", err)
+		}
+	})
+
+	t.Run("stat", func(t *testing.T) {
+		t.Run("inaccessible", func(t *testing.T) {
+			tempDir := t.TempDir()
+			pathname := path.Join(tempDir, "inaccessible")
+			if f, err := os.Create(pathname); err != nil {
+				t.Fatalf("Create: error = %v", err)
+			} else {
+				_ = f.Close()
+			}
+
+			if err := os.Chmod(tempDir, 0); err != nil {
+				t.Fatalf("Chmod: error = %v", err)
+			}
+
+			wantErr := &os.PathError{
+				Op:   "stat",
+				Path: pathname,
+				Err:  syscall.EACCES,
+			}
+			if err := ensureFile(pathname, 0644, 0755); !reflect.DeepEqual(err, wantErr) {
+				t.Errorf("ensureFile: error = %#v, want %#v", err, wantErr)
+			}
+
+			if err := os.Chmod(tempDir, 0755); err != nil {
+				t.Fatalf("Chmod: error = %v", err)
+			}
+		})
+
+		t.Run("directory", func(t *testing.T) {
+			pathname := t.TempDir()
+			wantErr := &os.PathError{Op: "ensure", Path: pathname, Err: syscall.EISDIR}
+			if err := ensureFile(pathname, 0644, 0755); !reflect.DeepEqual(err, wantErr) {
+				t.Errorf("ensureFile: error = %#v, want %#v", err, wantErr)
+			}
+		})
+
+		t.Run("ensure", func(t *testing.T) {
+			tempDir := t.TempDir()
+			pathname := path.Join(tempDir, "ensure")
+			if f, err := os.Create(pathname); err != nil {
+				t.Fatalf("Create: error = %v", err)
+			} else {
+				_ = f.Close()
+			}
+
+			if err := ensureFile(pathname, 0644, 0755); err != nil {
+				t.Errorf("ensureFile: error = %v", err)
+			}
+		})
+	})
+}
+
+func TestProcPaths(t *testing.T) {
+	t.Run("host", func(t *testing.T) {
+		t.Run("stdout", func(t *testing.T) {
+			want := "/host/proc/self/fd/1"
+			if got := hostProc.stdout(); got != want {
+				t.Errorf("stdout: %q, want %q", got, want)
+			}
+		})
+		t.Run("fd", func(t *testing.T) {
+			want := "/host/proc/self/fd/9223372036854775807"
+			if got := hostProc.fd(math.MaxInt64); got != want {
+				t.Errorf("stdout: %q, want %q", got, want)
+			}
+		})
+	})
+
+	t.Run("mountinfo", func(t *testing.T) {
+		t.Run("nonexistent", func(t *testing.T) {
+			nonexistentProc := newProcPaths(direct{}, t.TempDir())
+			wantErr := &os.PathError{
+				Op:   "open",
+				Path: nonexistentProc.self + "/mountinfo",
+				Err:  syscall.ENOENT,
+			}
+			if err := nonexistentProc.mountinfo(func(*vfs.MountInfoDecoder) error { return syscall.EINVAL }); !reflect.DeepEqual(err, wantErr) {
+				t.Errorf("mountinfo: error = %v, want %v", err, wantErr)
+			}
+		})
+
+		t.Run("sample", func(t *testing.T) {
+			tempDir := t.TempDir()
+			if err := os.MkdirAll(path.Join(tempDir, "proc/self"), 0755); err != nil {
+				t.Fatalf("MkdirAll: error = %v", err)
+			}
+
+			t.Run("clean", func(t *testing.T) {
+				if err := os.WriteFile(path.Join(tempDir, "proc/self/mountinfo"), []byte(`15 20 0:3 / /proc rw,relatime - proc /proc rw
+16 20 0:15 / /sys rw,relatime - sysfs /sys rw
+17 20 0:5 / /dev rw,relatime - devtmpfs udev rw,size=1983516k,nr_inodes=495879,mode=755`), 0644); err != nil {
+					t.Fatalf("WriteFile: error = %v", err)
+				}
+
+				var mountInfo *vfs.MountInfo
+				if err := newProcPaths(direct{}, tempDir).mountinfo(func(d *vfs.MountInfoDecoder) error { return d.Decode(&mountInfo) }); err != nil {
+					t.Fatalf("mountinfo: error = %v", err)
+				}
+
+				wantMountInfo := &vfs.MountInfo{Next: &vfs.MountInfo{Next: &vfs.MountInfo{
+					MountInfoEntry: vfs.MountInfoEntry{ID: 17, Parent: 20, Devno: vfs.DevT{0, 5}, Root: "/", Target: "/dev", VfsOptstr: "rw,relatime", OptFields: []string{}, FsType: "devtmpfs", Source: "udev", FsOptstr: "rw,size=1983516k,nr_inodes=495879,mode=755"}},
+					MountInfoEntry: vfs.MountInfoEntry{ID: 16, Parent: 20, Devno: vfs.DevT{0, 15}, Root: "/", Target: "/sys", VfsOptstr: "rw,relatime", OptFields: []string{}, FsType: "sysfs", Source: "/sys", FsOptstr: "rw"}},
+					MountInfoEntry: vfs.MountInfoEntry{ID: 15, Parent: 20, Devno: vfs.DevT{0, 3}, Root: "/", Target: "/proc", VfsOptstr: "rw,relatime", OptFields: []string{}, FsType: "proc", Source: "/proc", FsOptstr: "rw"},
+				}
+				if !reflect.DeepEqual(mountInfo, wantMountInfo) {
+					t.Errorf("Decode: %#v, want %#v", mountInfo, wantMountInfo)
+				}
+			})
+
+			t.Run("closed", func(t *testing.T) {
+				p := newProcPaths(direct{}, tempDir)
+				wantErr := &os.PathError{
+					Op:   "close",
+					Path: p.self + "/mountinfo",
+					Err:  os.ErrClosed,
+				}
+				if err := p.mountinfo(func(d *vfs.MountInfoDecoder) error {
+					v := reflect.ValueOf(d).Elem().FieldByName("s").Elem().FieldByName("r")
+					v = reflect.NewAt(v.Type(), unsafe.Pointer(v.UnsafeAddr()))
+					if f, ok := v.Elem().Interface().(io.ReadCloser); !ok {
+						t.Fatal("implementation of bufio.Scanner no longer compatible with this fault injection")
+						return syscall.ENOTRECOVERABLE
+					} else {
+						return f.Close()
+					}
+				}); !reflect.DeepEqual(err, wantErr) {
+					t.Errorf("mountinfo: error = %#v, want %#v", err, wantErr)
+				}
+			})
+
+			t.Run("malformed", func(t *testing.T) {
+				path.Join(tempDir, "proc/self/mountinfo")
+				if err := os.WriteFile(path.Join(tempDir, "proc/self/mountinfo"), []byte{0}, 0644); err != nil {
+					t.Fatalf("WriteFile: error = %v", err)
+				}
+
+				wantErr := &vfs.DecoderError{Op: "parse", Line: 0, Err: vfs.ErrMountInfoFields}
+				if err := newProcPaths(direct{}, tempDir).mountinfo(func(d *vfs.MountInfoDecoder) error { return d.Decode(new(*vfs.MountInfo)) }); !reflect.DeepEqual(err, wantErr) {
+					t.Fatalf("mountinfo: error = %v, want %v", err, wantErr)
+				}
+			})
+		})
+	})
+}

container/seccomp/libseccomp_test.go

@@ -79,7 +79,7 @@ func TestExport(t *testing.T) {
 
 func BenchmarkExport(b *testing.B) {
 	buf := make([]byte, 8)
-	for i := 0; i < b.N; i++ {
+	for b.Loop() {
 		e := New(
 			Preset(PresetExt|PresetDenyNS|PresetDenyTTY|PresetDenyDevel|PresetLinux32,
 				AllowMultiarch|AllowCAN|AllowBluetooth),

container/stub/call.go

@@ -0,0 +1,37 @@
+package stub
+
+import (
+	"slices"
+)
+
+// ExpectArgs is an array primarily for storing expected function arguments.
+// Its actual use is defined by the implementation.
+type ExpectArgs = [5]any
+
+// An Expect stores expected calls of a goroutine.
+type Expect struct {
+	Calls []Call
+
+	// Tracks are handed out to descendant goroutines in order.
+	Tracks []Expect
+}
+
+// A Call holds expected arguments of a function call and its outcome.
+type Call struct {
+	// Name is the function Name of this call. Must be unique.
+	Name string
+	// Args are the expected arguments of this Call.
+	Args ExpectArgs
+	// Ret is the return value of this Call.
+	Ret any
+	// Err is the returned error of this Call.
+	Err error
+}
+
+// Error returns [Call.Err] if all arguments are true, or [ErrCheck] otherwise.
+func (k *Call) Error(ok ...bool) error {
+	if !slices.Contains(ok, false) {
+		return k.Err
+	}
+	return ErrCheck
+}

container/stub/call_test.go

@@ -0,0 +1,23 @@
+package stub_test
+
+import (
+	"reflect"
+	"testing"
+
+	"hakurei.app/container/stub"
+)
+
+func TestCallError(t *testing.T) {
+	t.Run("contains false", func(t *testing.T) {
+		if err := new(stub.Call).Error(true, false, true); !reflect.DeepEqual(err, stub.ErrCheck) {
+			t.Errorf("Error: %#v, want %#v", err, stub.ErrCheck)
+		}
+	})
+
+	t.Run("passthrough", func(t *testing.T) {
+		wantErr := stub.UniqueError(0xbabe)
+		if err := (&stub.Call{Err: wantErr}).Error(true); !reflect.DeepEqual(err, wantErr) {
+			t.Errorf("Error: %#v, want %#v", err, wantErr)
+		}
+	})
+}

container/stub/errors.go

@@ -0,0 +1,25 @@
+package stub
+
+import (
+	"errors"
+	"strconv"
+)
+
+var (
+	ErrCheck = errors.New("one or more arguments did not match")
+)
+
+// UniqueError is an error that only equivalates to other [UniqueError] with the same magic value.
+type UniqueError uintptr
+
+func (e UniqueError) Error() string {
+	return "unique error " + strconv.Itoa(int(e)) + " injected by the test suite"
+}
+
+func (e UniqueError) Is(target error) bool {
+	var u UniqueError
+	if !errors.As(target, &u) {
+		return false
+	}
+	return e == u
+}

container/stub/errors_test.go

@@ -0,0 +1,35 @@
+package stub_test
+
+import (
+	"errors"
+	"syscall"
+	"testing"
+
+	"hakurei.app/container/stub"
+)
+
+func TestUniqueError(t *testing.T) {
+	t.Run("format", func(t *testing.T) {
+		want := "unique error 2989 injected by the test suite"
+		if got := stub.UniqueError(0xbad).Error(); got != want {
+			t.Errorf("Error: %q, want %q", got, want)
+		}
+	})
+
+	t.Run("is", func(t *testing.T) {
+		t.Run("type", func(t *testing.T) {
+			if errors.Is(stub.UniqueError(0), syscall.ENOTRECOVERABLE) {
+				t.Error("Is: unexpected true")
+			}
+		})
+
+		t.Run("val", func(t *testing.T) {
+			if errors.Is(stub.UniqueError(0), stub.UniqueError(1)) {
+				t.Error("Is: unexpected true")
+			}
+			if !errors.Is(stub.UniqueError(0xbad), stub.UniqueError(0xbad)) {
+				t.Error("Is: unexpected false")
+			}
+		})
+	})
+}

container/stub/exit.go

@@ -0,0 +1,44 @@
+package stub
+
+import "testing"
+
+// PanicExit is a magic panic value treated as a simulated exit.
+const PanicExit = 0xdeadbeef
+
+const (
+	panicFailNow = 0xcafe0000 + iota
+	panicFatal
+	panicFatalf
+)
+
+// HandleExit must be deferred before calling with the stub.
+func HandleExit(t testing.TB) {
+	switch r := recover(); r {
+	case PanicExit:
+		break
+
+	case panicFailNow:
+		t.FailNow()
+
+	case panicFatal, panicFatalf, nil:
+		break
+
+	default:
+		panic(r)
+	}
+}
+
+// handleExitNew handles exits from goroutines created by [Stub.New].
+func handleExitNew(t testing.TB) {
+	switch r := recover(); r {
+	case PanicExit, panicFatal, panicFatalf, nil:
+		break
+
+	case panicFailNow:
+		t.Fail()
+		break
+
+	default:
+		panic(r)
+	}
+}

container/stub/exit_test.go

@@ -0,0 +1,93 @@
+package stub_test
+
+import (
+	"testing"
+	_ "unsafe"
+
+	"hakurei.app/container/stub"
+)
+
+//go:linkname handleExitNew hakurei.app/container/stub.handleExitNew
+func handleExitNew(_ testing.TB)
+
+// overrideTFailNow overrides the Fail and FailNow method.
+type overrideTFailNow struct {
+	*testing.T
+	failNow bool
+	fail    bool
+}
+
+func (o *overrideTFailNow) FailNow() {
+	if o.failNow {
+		o.Errorf("attempted to FailNow twice")
+	}
+	o.failNow = true
+}
+
+func (o *overrideTFailNow) Fail() {
+	if o.fail {
+		o.Errorf("attempted to Fail twice")
+	}
+	o.fail = true
+}
+
+func TestHandleExit(t *testing.T) {
+	t.Run("exit", func(t *testing.T) {
+		defer stub.HandleExit(t)
+		panic(stub.PanicExit)
+	})
+
+	t.Run("goexit", func(t *testing.T) {
+		t.Run("FailNow", func(t *testing.T) {
+			ot := &overrideTFailNow{T: t}
+			defer func() {
+				if !ot.failNow {
+					t.Errorf("FailNow was never called")
+				}
+			}()
+			defer stub.HandleExit(ot)
+			panic(0xcafe0000)
+		})
+
+		t.Run("Fail", func(t *testing.T) {
+			ot := &overrideTFailNow{T: t}
+			defer func() {
+				if !ot.fail {
+					t.Errorf("Fail was never called")
+				}
+			}()
+			defer handleExitNew(ot)
+			panic(0xcafe0000)
+		})
+	})
+
+	t.Run("nil", func(t *testing.T) {
+		defer stub.HandleExit(t)
+	})
+
+	t.Run("passthrough", func(t *testing.T) {
+		t.Run("toplevel", func(t *testing.T) {
+			defer func() {
+				want := 0xcafebabe
+				if r := recover(); r != want {
+					t.Errorf("recover: %v, want %v", r, want)
+				}
+
+			}()
+			defer stub.HandleExit(t)
+			panic(0xcafebabe)
+		})
+
+		t.Run("new", func(t *testing.T) {
+			defer func() {
+				want := 0xcafe
+				if r := recover(); r != want {
+					t.Errorf("recover: %v, want %v", r, want)
+				}
+
+			}()
+			defer handleExitNew(t)
+			panic(0xcafe)
+		})
+	})
+}

container/stub/stub.go

@@ -0,0 +1,148 @@
+// Package stub provides function call level stubbing and validation
+// for library functions that are impossible to check otherwise.
+package stub
+
+import (
+	"reflect"
+	"sync"
+	"testing"
+)
+
+// this should prevent stub from being inadvertently imported outside tests
+var _ = func() {
+	if !testing.Testing() {
+		panic("stub imported while not in a test")
+	}
+}
+
+const (
+	// A CallSeparator denotes an injected separation between two groups of calls.
+	CallSeparator = "\x00"
+)
+
+// A Stub is a collection of tracks of expected calls.
+type Stub[K any] struct {
+	testing.TB
+
+	// makeK creates a new K for a descendant [Stub].
+	// This function may be called concurrently.
+	makeK func(s *Stub[K]) K
+
+	// want is a hierarchy of expected calls.
+	want Expect
+	// pos is the current position in [Expect.Calls].
+	pos int
+	// goroutine counts the number of goroutines created by this [Stub].
+	goroutine int
+	// sub stores the addresses of descendant [Stub] created by New.
+	sub []*Stub[K]
+	// wg waits for all descendants to complete.
+	wg *sync.WaitGroup
+}
+
+// New creates a root [Stub].
+func New[K any](tb testing.TB, makeK func(s *Stub[K]) K, want Expect) *Stub[K] {
+	return &Stub[K]{TB: tb, makeK: makeK, want: want, wg: new(sync.WaitGroup)}
+}
+
+func (s *Stub[K]) FailNow()                          { panic(panicFailNow) }
+func (s *Stub[K]) Fatal(args ...any)                 { s.Error(args...); panic(panicFatal) }
+func (s *Stub[K]) Fatalf(format string, args ...any) { s.Errorf(format, args...); panic(panicFatalf) }
+func (s *Stub[K]) SkipNow()                          { panic("invalid call to SkipNow") }
+func (s *Stub[K]) Skip(...any)                       { panic("invalid call to Skip") }
+func (s *Stub[K]) Skipf(string, ...any)              { panic("invalid call to Skipf") }
+
+// New calls f in a new goroutine
+func (s *Stub[K]) New(f func(k K)) {
+	s.Helper()
+
+	s.Expects("New")
+	if len(s.want.Tracks) <= s.goroutine {
+		s.Fatal("New: track overrun")
+	}
+	ds := &Stub[K]{TB: s.TB, makeK: s.makeK, want: s.want.Tracks[s.goroutine], wg: s.wg}
+	s.goroutine++
+	s.sub = append(s.sub, ds)
+	s.wg.Add(1)
+	go func() {
+		s.Helper()
+
+		defer s.wg.Done()
+		defer handleExitNew(s.TB)
+		f(s.makeK(ds))
+	}()
+}
+
+// Pos returns the current position of [Stub] in its [Expect.Calls]
+func (s *Stub[K]) Pos() int { return s.pos }
+
+// Len returns the length of [Expect.Calls].
+func (s *Stub[K]) Len() int { return len(s.want.Calls) }
+
+// VisitIncomplete calls f on an incomplete s and all its descendants.
+func (s *Stub[K]) VisitIncomplete(f func(s *Stub[K])) {
+	s.Helper()
+	s.wg.Wait()
+
+	if s.want.Calls != nil && len(s.want.Calls) != s.pos {
+		f(s)
+	}
+	for _, ds := range s.sub {
+		ds.VisitIncomplete(f)
+	}
+}
+
+// Expects checks the name of and returns the current [Call] and advances pos.
+func (s *Stub[K]) Expects(name string) (expect *Call) {
+	s.Helper()
+
+	if len(s.want.Calls) == s.pos {
+		s.Fatal("Expects: advancing beyond expected calls")
+	}
+	expect = &s.want.Calls[s.pos]
+	if name != expect.Name {
+		if expect.Name == CallSeparator {
+			s.Fatalf("Expects: func = %s, separator overrun", name)
+		}
+		if name == CallSeparator {
+			s.Fatalf("Expects: separator, want %s", expect.Name)
+		}
+		s.Fatalf("Expects: func = %s, want %s", name, expect.Name)
+	}
+	s.pos++
+	return
+}
+
+// CheckArg checks an argument comparable with the == operator. Avoid using this with pointers.
+func CheckArg[T comparable, K any](s *Stub[K], arg string, got T, n int) bool {
+	s.Helper()
+
+	pos := s.pos - 1
+	if pos < 0 || pos >= len(s.want.Calls) {
+		panic("invalid call to CheckArg")
+	}
+	expect := s.want.Calls[pos]
+	want, ok := expect.Args[n].(T)
+	if !ok || got != want {
+		s.Errorf("%s: %s = %#v, want %#v (%d)", expect.Name, arg, got, want, pos)
+		return false
+	}
+	return true
+}
+
+// CheckArgReflect checks an argument of any type.
+func CheckArgReflect[K any](s *Stub[K], arg string, got any, n int) bool {
+	s.Helper()
+
+	pos := s.pos - 1
+	if pos < 0 || pos >= len(s.want.Calls) {
+		panic("invalid call to CheckArgReflect")
+	}
+	expect := s.want.Calls[pos]
+	want := expect.Args[n]
+	if !reflect.DeepEqual(got, want) {
+		s.Errorf("%s: %s = %#v, want %#v (%d)", expect.Name, arg, got, want, pos)
+		return false
+	}
+	return true
+}

container/stub/stub_test.go

@@ -0,0 +1,296 @@
+package stub
+
+import (
+	"reflect"
+	"sync/atomic"
+	"testing"
+)
+
+// stubHolder embeds [Stub].
+type stubHolder struct{ *Stub[stubHolder] }
+
+// overrideT allows some methods of [testing.T] to be overridden.
+type overrideT struct {
+	*testing.T
+
+	error  atomic.Pointer[func(args ...any)]
+	errorf atomic.Pointer[func(format string, args ...any)]
+}
+
+func (t *overrideT) Error(args ...any) {
+	fp := t.error.Load()
+	if fp == nil || *fp == nil {
+		t.T.Error(args...)
+		return
+	}
+	(*fp)(args...)
+}
+
+func (t *overrideT) Errorf(format string, args ...any) {
+	fp := t.errorf.Load()
+	if fp == nil || *fp == nil {
+		t.T.Errorf(format, args...)
+		return
+	}
+	(*fp)(format, args...)
+}
+
+func TestStub(t *testing.T) {
+	t.Run("goexit", func(t *testing.T) {
+		t.Run("FailNow", func(t *testing.T) {
+			defer func() {
+				if r := recover(); r != panicFailNow {
+					t.Errorf("recover: %v", r)
+				}
+			}()
+			new(stubHolder).FailNow()
+		})
+
+		t.Run("SkipNow", func(t *testing.T) {
+			defer func() {
+				want := "invalid call to SkipNow"
+				if r := recover(); r != want {
+					t.Errorf("recover: %v, want %v", r, want)
+				}
+			}()
+			new(stubHolder).SkipNow()
+		})
+
+		t.Run("Skip", func(t *testing.T) {
+			defer func() {
+				want := "invalid call to Skip"
+				if r := recover(); r != want {
+					t.Errorf("recover: %v, want %v", r, want)
+				}
+			}()
+			new(stubHolder).Skip()
+		})
+
+		t.Run("Skipf", func(t *testing.T) {
+			defer func() {
+				want := "invalid call to Skipf"
+				if r := recover(); r != want {
+					t.Errorf("recover: %v, want %v", r, want)
+				}
+			}()
+			new(stubHolder).Skipf("")
+		})
+	})
+
+	t.Run("new", func(t *testing.T) {
+		t.Run("success", func(t *testing.T) {
+			s := New(t, func(s *Stub[stubHolder]) stubHolder { return stubHolder{s} }, Expect{Calls: []Call{
+				{"New", ExpectArgs{}, nil, nil},
+			}, Tracks: []Expect{{Calls: []Call{
+				{"done", ExpectArgs{0xbabe}, nil, nil},
+			}}}})
+
+			s.New(func(k stubHolder) {
+				expect := k.Expects("done")
+				if expect.Name != "done" {
+					t.Errorf("New: Name = %s, want done", expect.Name)
+				}
+				if expect.Args != (ExpectArgs{0xbabe}) {
+					t.Errorf("New: Args = %#v", expect.Args)
+				}
+				if expect.Ret != nil {
+					t.Errorf("New: Ret = %#v", expect.Ret)
+				}
+				if expect.Err != nil {
+					t.Errorf("New: Err = %#v", expect.Err)
+				}
+			})
+
+			if pos := s.Pos(); pos != 1 {
+				t.Errorf("Pos: %d, want 1", pos)
+			}
+			if l := s.Len(); l != 1 {
+				t.Errorf("Len: %d, want 1", l)
+			}
+
+			s.VisitIncomplete(func(s *Stub[stubHolder]) { panic("unreachable") })
+		})
+
+		t.Run("overrun", func(t *testing.T) {
+			ot := &overrideT{T: t}
+			ot.error.Store(checkError(t, "New: track overrun"))
+			s := New(ot, func(s *Stub[stubHolder]) stubHolder { return stubHolder{s} }, Expect{Calls: []Call{
+				{"New", ExpectArgs{}, nil, nil},
+				{"panic", ExpectArgs{"unreachable"}, nil, nil},
+			}})
+			func() { defer HandleExit(t); s.New(func(k stubHolder) { panic("unreachable") }) }()
+
+			var visit int
+			s.VisitIncomplete(func(s *Stub[stubHolder]) {
+				visit++
+				if visit > 1 {
+					panic("unexpected visit count")
+				}
+
+				want := Call{"panic", ExpectArgs{"unreachable"}, nil, nil}
+				if got := s.want.Calls[s.pos]; !reflect.DeepEqual(got, want) {
+					t.Errorf("VisitIncomplete: %#v, want %#v", got, want)
+				}
+			})
+		})
+
+		t.Run("expects", func(t *testing.T) {
+			t.Run("overrun", func(t *testing.T) {
+				ot := &overrideT{T: t}
+				ot.error.Store(checkError(t, "Expects: advancing beyond expected calls"))
+				s := New(ot, func(s *Stub[stubHolder]) stubHolder { return stubHolder{s} }, Expect{})
+				func() { defer HandleExit(t); s.Expects("unreachable") }()
+			})
+
+			t.Run("separator", func(t *testing.T) {
+				t.Run("overrun", func(t *testing.T) {
+					ot := &overrideT{T: t}
+					ot.errorf.Store(checkErrorf(t, "Expects: func = %s, separator overrun", "meow"))
+					s := New(ot, func(s *Stub[stubHolder]) stubHolder { return stubHolder{s} }, Expect{Calls: []Call{
+						{CallSeparator, ExpectArgs{}, nil, nil},
+					}})
+					func() { defer HandleExit(t); s.Expects("meow") }()
+				})
+
+				t.Run("mismatch", func(t *testing.T) {
+					ot := &overrideT{T: t}
+					ot.errorf.Store(checkErrorf(t, "Expects: separator, want %s", "panic"))
+					s := New(ot, func(s *Stub[stubHolder]) stubHolder { return stubHolder{s} }, Expect{Calls: []Call{
+						{"panic", ExpectArgs{}, nil, nil},
+					}})
+					func() { defer HandleExit(t); s.Expects(CallSeparator) }()
+				})
+			})
+
+			t.Run("mismatch", func(t *testing.T) {
+				ot := &overrideT{T: t}
+				ot.errorf.Store(checkErrorf(t, "Expects: func = %s, want %s", "meow", "nya"))
+				s := New(ot, func(s *Stub[stubHolder]) stubHolder { return stubHolder{s} }, Expect{Calls: []Call{
+					{"nya", ExpectArgs{}, nil, nil},
+				}})
+				func() { defer HandleExit(t); s.Expects("meow") }()
+			})
+		})
+	})
+}
+
+func TestCheckArg(t *testing.T) {
+	t.Run("oob negative", func(t *testing.T) {
+		defer func() {
+			want := "invalid call to CheckArg"
+			if r := recover(); r != want {
+				t.Errorf("recover: %v, want %v", r, want)
+			}
+		}()
+		s := New(t, func(s *Stub[stubHolder]) stubHolder { return stubHolder{s} }, Expect{})
+		CheckArg(s, "unreachable", struct{}{}, 0)
+	})
+
+	ot := &overrideT{T: t}
+	s := New(ot, func(s *Stub[stubHolder]) stubHolder { return stubHolder{s} }, Expect{Calls: []Call{
+		{"panic", ExpectArgs{PanicExit}, nil, nil},
+		{"meow", ExpectArgs{-1}, nil, nil},
+	}})
+	t.Run("match", func(t *testing.T) {
+		s.Expects("panic")
+		if !CheckArg(s, "v", PanicExit, 0) {
+			t.Errorf("CheckArg: unexpected false")
+		}
+	})
+	t.Run("mismatch", func(t *testing.T) {
+		defer HandleExit(t)
+		s.Expects("meow")
+		ot.errorf.Store(checkErrorf(t, "%s: %s = %#v, want %#v (%d)", "meow", "time", 0, -1, 1))
+		if CheckArg(s, "time", 0, 0) {
+			t.Errorf("CheckArg: unexpected true")
+		}
+	})
+	t.Run("oob", func(t *testing.T) {
+		s.pos++
+		defer func() {
+			want := "invalid call to CheckArg"
+			if r := recover(); r != want {
+				t.Errorf("recover: %v, want %v", r, want)
+			}
+		}()
+		CheckArg(s, "unreachable", struct{}{}, 0)
+	})
+}
+
+func TestCheckArgReflect(t *testing.T) {
+	t.Run("oob lower", func(t *testing.T) {
+		defer func() {
+			want := "invalid call to CheckArgReflect"
+			if r := recover(); r != want {
+				t.Errorf("recover: %v, want %v", r, want)
+			}
+		}()
+		s := New(t, func(s *Stub[stubHolder]) stubHolder { return stubHolder{s} }, Expect{})
+		CheckArgReflect(s, "unreachable", struct{}{}, 0)
+	})
+
+	ot := &overrideT{T: t}
+	s := New(ot, func(s *Stub[stubHolder]) stubHolder { return stubHolder{s} }, Expect{Calls: []Call{
+		{"panic", ExpectArgs{PanicExit}, nil, nil},
+		{"meow", ExpectArgs{-1}, nil, nil},
+	}})
+	t.Run("match", func(t *testing.T) {
+		s.Expects("panic")
+		if !CheckArgReflect(s, "v", PanicExit, 0) {
+			t.Errorf("CheckArgReflect: unexpected false")
+		}
+	})
+	t.Run("mismatch", func(t *testing.T) {
+		defer HandleExit(t)
+		s.Expects("meow")
+		ot.errorf.Store(checkErrorf(t, "%s: %s = %#v, want %#v (%d)", "meow", "time", 0, -1, 1))
+		if CheckArgReflect(s, "time", 0, 0) {
+			t.Errorf("CheckArgReflect: unexpected true")
+		}
+	})
+	t.Run("oob", func(t *testing.T) {
+		s.pos++
+		defer func() {
+			want := "invalid call to CheckArgReflect"
+			if r := recover(); r != want {
+				t.Errorf("recover: %v, want %v", r, want)
+			}
+		}()
+		CheckArgReflect(s, "unreachable", struct{}{}, 0)
+	})
+}
+
+func checkError(t *testing.T, wantArgs ...any) *func(args ...any) {
+	var called bool
+	f := func(args ...any) {
+		if called {
+			panic("invalid call to error")
+		}
+		called = true
+
+		if !reflect.DeepEqual(args, wantArgs) {
+			t.Errorf("Error: %#v, want %#v", args, wantArgs)
+		}
+		panic(PanicExit)
+	}
+	return &f
+}
+
+func checkErrorf(t *testing.T, wantFormat string, wantArgs ...any) *func(format string, args ...any) {
+	var called bool
+	f := func(format string, args ...any) {
+		if called {
+			panic("invalid call to errorf")
+		}
+		called = true
+
+		if format != wantFormat {
+			t.Errorf("Errorf: format = %q, want %q", format, wantFormat)
+		}
+		if !reflect.DeepEqual(args, wantArgs) {
+			t.Errorf("Errorf: args = %#v, want %#v", args, wantArgs)
+		}
+		panic(PanicExit)
+	}
+	return &f
+}

container/syscall.go

@@ -2,13 +2,24 @@ package container
 
 import (
 	"syscall"
+	"unsafe"
 )
 
+// SetPtracer allows processes to ptrace(2) the calling process.
+func SetPtracer(pid uintptr) error {
+	_, _, errno := syscall.Syscall(syscall.SYS_PRCTL, syscall.PR_SET_PTRACER, pid, 0)
+	if errno == 0 {
+		return nil
+	}
+	return errno
+}
+
 const (
 	SUID_DUMP_DISABLE = iota
 	SUID_DUMP_USER
 )
 
+// SetDumpable sets the "dumpable" attribute of the calling process.
 func SetDumpable(dumpable uintptr) error {
 	// linux/sched/coredump.h
 	if _, _, errno := syscall.Syscall(syscall.SYS_PRCTL, syscall.PR_SET_DUMPABLE, dumpable, 0); errno != 0 {
@@ -18,6 +29,27 @@ func SetDumpable(dumpable uintptr) error {
 	return nil
 }
 
+// SetNoNewPrivs sets the calling thread's no_new_privs attribute.
+func SetNoNewPrivs() error {
+	_, _, errno := syscall.Syscall(syscall.SYS_PRCTL, PR_SET_NO_NEW_PRIVS, 1, 0)
+	if errno == 0 {
+		return nil
+	}
+	return errno
+}
+
+// Isatty tests whether a file descriptor refers to a terminal.
+func Isatty(fd int) bool {
+	var buf [8]byte
+	r, _, _ := syscall.Syscall(
+		syscall.SYS_IOCTL,
+		uintptr(fd),
+		syscall.TIOCGWINSZ,
+		uintptr(unsafe.Pointer(&buf[0])),
+	)
+	return r == 0
+}
+
 // IgnoringEINTR makes a function call and repeats it if it returns an
 // EINTR error. This appears to be required even though we install all
 // signal handlers with SA_RESTART: see #22838, #38033, #38836, #40846.

container/sysctl.go

@@ -17,9 +17,9 @@ var (
 )
 
 const (
-	kernelOverflowuidPath = "/proc/sys/kernel/overflowuid"
-	kernelOverflowgidPath = "/proc/sys/kernel/overflowgid"
-	kernelCapLastCapPath  = "/proc/sys/kernel/cap_last_cap"
+	kernelOverflowuidPath = FHSProcSys + "kernel/overflowuid"
+	kernelOverflowgidPath = FHSProcSys + "kernel/overflowgid"
+	kernelCapLastCapPath  = FHSProcSys + "kernel/cap_last_cap"
 )
 
 func mustReadSysctl() {

container/vfs/mountinfo.go

@@ -24,6 +24,32 @@ var (
 	ErrMountInfoSep    = errors.New("bad optional fields separator")
 )
 
+type DecoderError struct {
+	Op   string
+	Line int
+	Err  error
+}
+
+func (e *DecoderError) Unwrap() error { return e.Err }
+func (e *DecoderError) Error() string {
+	var s string
+
+	var numError *strconv.NumError
+	switch {
+	case errors.As(e.Err, &numError) && numError != nil:
+		s = "numeric field " + strconv.Quote(numError.Num) + " " + numError.Err.Error()
+
+	default:
+		s = e.Err.Error()
+	}
+
+	var atLine string
+	if e.Line >= 0 {
+		atLine = " at line " + strconv.Itoa(e.Line)
+	}
+	return e.Op + " mountinfo" + atLine + ": " + s
+}
+
 type (
 	// A MountInfoDecoder reads and decodes proc_pid_mountinfo(5) entries from an input stream.
 	MountInfoDecoder struct {
@@ -32,6 +58,7 @@ type (
 
 		current  *MountInfo
 		parseErr error
+		curLine  int
 		complete bool
 	}
 
@@ -132,9 +159,12 @@ func (d *MountInfoDecoder) Entries() iter.Seq[*MountInfoEntry] {
 
 func (d *MountInfoDecoder) Err() error {
 	if err := d.s.Err(); err != nil {
-		return err
+		return &DecoderError{"scan", d.curLine, err}
 	}
-	return d.parseErr
+	if d.parseErr != nil {
+		return &DecoderError{"parse", d.curLine, d.parseErr}
+	}
+	return nil
 }
 
 func (d *MountInfoDecoder) scan() bool {
@@ -160,6 +190,7 @@ func (d *MountInfoDecoder) scan() bool {
 		d.current.Next = m
 		d.current = d.current.Next
 	}
+	d.curLine++
 	return true
 }
 

container/vfs/mountinfo_test.go

@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"errors"
 	"iter"
+	"os"
 	"path"
 	"reflect"
 	"slices"
@@ -15,62 +16,102 @@ import (
 	"hakurei.app/container/vfs"
 )
 
+func TestDecoderError(t *testing.T) {
+	testCases := []struct {
+		name    string
+		err     *vfs.DecoderError
+		want    string
+		target  error
+		targetF error
+	}{
+		{"errno", &vfs.DecoderError{Op: "parse", Line: 0xdeadbeef, Err: syscall.ENOTRECOVERABLE},
+			"parse mountinfo at line 3735928559: state not recoverable", syscall.ENOTRECOVERABLE, syscall.EROFS},
+
+		{"strconv", &vfs.DecoderError{Op: "parse", Line: 0xdeadbeef, Err: &strconv.NumError{Func: "Atoi", Num: "meow", Err: strconv.ErrSyntax}},
+			`parse mountinfo at line 3735928559: numeric field "meow" invalid syntax`, strconv.ErrSyntax, os.ErrInvalid},
+
+		{"unfold", &vfs.DecoderError{Op: "unfold", Line: -1, Err: vfs.UnfoldTargetError("/proc/nonexistent")},
+			"unfold mountinfo: mount point /proc/nonexistent never appeared in mountinfo", vfs.UnfoldTargetError("/proc/nonexistent"), os.ErrNotExist},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Run("error", func(t *testing.T) {
+				if got := tc.err.Error(); got != tc.want {
+					t.Errorf("Error: %s, want %s", got, tc.want)
+				}
+			})
+
+			t.Run("is", func(t *testing.T) {
+				if !errors.Is(tc.err, tc.target) {
+					t.Errorf("Is: unexpected false")
+				}
+				if errors.Is(tc.err, tc.targetF) {
+					t.Errorf("Is: unexpected true")
+				}
+			})
+		})
+	}
+}
+
 func TestMountInfo(t *testing.T) {
 	testCases := []mountInfoTest{
 		{"count", sampleMountinfoBase + `
 21 20 0:53/ /mnt/test rw,relatime - tmpfs  rw
 21 16 0:17 / /sys/fs/cgroup rw,nosuid,nodev,noexec,relatime - tmpfs tmpfs rw,mode=755`,
-			vfs.ErrMountInfoFields, "", nil, nil, nil},
+			&vfs.DecoderError{Op: "parse", Line: 6, Err: vfs.ErrMountInfoFields},
+			"", nil, nil, nil},
 
 		{"sep", sampleMountinfoBase + `
 21 20 0:53 / /mnt/test rw,relatime shared:212 _ tmpfs  rw
 21 16 0:17 / /sys/fs/cgroup rw,nosuid,nodev,noexec,relatime - tmpfs tmpfs rw,mode=755`,
-			vfs.ErrMountInfoSep, "", nil, nil, nil},
+			&vfs.DecoderError{Op: "parse", Line: 6, Err: vfs.ErrMountInfoSep},
+			"", nil, nil, nil},
 
 		{"id", sampleMountinfoBase + `
 id 20 0:53 / /mnt/test rw,relatime shared:212 - tmpfs  rw
 21 16 0:17 / /sys/fs/cgroup rw,nosuid,nodev,noexec,relatime - tmpfs tmpfs rw,mode=755`,
-			strconv.ErrSyntax, "", nil, nil, nil},
+			&vfs.DecoderError{Op: "parse", Line: 6, Err: &strconv.NumError{Func: "Atoi", Num: "id", Err: strconv.ErrSyntax}},
+			"", nil, nil, nil},
 
 		{"parent", sampleMountinfoBase + `
 21 parent 0:53 / /mnt/test rw,relatime shared:212 - tmpfs  rw
 21 16 0:17 / /sys/fs/cgroup rw,nosuid,nodev,noexec,relatime - tmpfs tmpfs rw,mode=755`,
-			strconv.ErrSyntax, "", nil, nil, nil},
+			&vfs.DecoderError{Op: "parse", Line: 6, Err: &strconv.NumError{Func: "Atoi", Num: "parent", Err: strconv.ErrSyntax}}, "", nil, nil, nil},
 
 		{"devno", sampleMountinfoBase + `
 21 20 053 / /mnt/test rw,relatime shared:212 - tmpfs  rw
 21 16 0:17 / /sys/fs/cgroup rw,nosuid,nodev,noexec,relatime - tmpfs tmpfs rw,mode=755`,
-			nil, "unexpected EOF", nil, nil, nil},
+			nil, "parse mountinfo at line 6: unexpected EOF", nil, nil, nil},
 
 		{"maj", sampleMountinfoBase + `
 21 20 maj:53 / /mnt/test rw,relatime shared:212 - tmpfs  rw
 21 16 0:17 / /sys/fs/cgroup rw,nosuid,nodev,noexec,relatime - tmpfs tmpfs rw,mode=755`,
-			nil, "expected integer", nil, nil, nil},
+			nil, "parse mountinfo at line 6: expected integer", nil, nil, nil},
 
 		{"min", sampleMountinfoBase + `
 21 20 0:min / /mnt/test rw,relatime shared:212 - tmpfs  rw
 21 16 0:17 / /sys/fs/cgroup rw,nosuid,nodev,noexec,relatime - tmpfs tmpfs rw,mode=755`,
-			nil, "expected integer", nil, nil, nil},
+			nil, "parse mountinfo at line 6: expected integer", nil, nil, nil},
 
 		{"mountroot", sampleMountinfoBase + `
 21 20 0:53  /mnt/test rw,relatime - tmpfs  rw
 21 16 0:17 / /sys/fs/cgroup rw,nosuid,nodev,noexec,relatime - tmpfs tmpfs rw,mode=755`,
-			vfs.ErrMountInfoEmpty, "", nil, nil, nil},
+			&vfs.DecoderError{Op: "parse", Line: 6, Err: vfs.ErrMountInfoEmpty}, "", nil, nil, nil},
 
 		{"target", sampleMountinfoBase + `
 21 20 0:53 /  rw,relatime - tmpfs  rw
 21 16 0:17 / /sys/fs/cgroup rw,nosuid,nodev,noexec,relatime - tmpfs tmpfs rw,mode=755`,
-			vfs.ErrMountInfoEmpty, "", nil, nil, nil},
+			&vfs.DecoderError{Op: "parse", Line: 6, Err: vfs.ErrMountInfoEmpty}, "", nil, nil, nil},
 
 		{"vfs options", sampleMountinfoBase + `
 21 20 0:53 / /mnt/test  - tmpfs  rw
 21 16 0:17 / /sys/fs/cgroup rw,nosuid,nodev,noexec,relatime - tmpfs tmpfs rw,mode=755`,
-			vfs.ErrMountInfoEmpty, "", nil, nil, nil},
+			&vfs.DecoderError{Op: "parse", Line: 6, Err: vfs.ErrMountInfoEmpty}, "", nil, nil, nil},
 
 		{"FS type", sampleMountinfoBase + `
-21 20 0:53 / /mnt/test rw,relatime -   rw
-21 16 0:17 / /sys/fs/cgroup rw,nosuid,nodev,noexec,relatime - tmpfs tmpfs rw,mode=755`,
-			vfs.ErrMountInfoEmpty, "", nil, nil, nil},
+21 16 0:17 / /sys/fs/cgroup rw,nosuid,nodev,noexec,relatime - tmpfs tmpfs rw,mode=755
+21 20 0:53 / /mnt/test rw,relatime -   rw`,
+			&vfs.DecoderError{Op: "parse", Line: 7, Err: vfs.ErrMountInfoEmpty}, "", nil, nil, nil},
 
 		{"base", sampleMountinfoBase, nil, "", []*wantMountInfo{
 			m(15, 20, 0, 3, "/", "/proc", "rw,relatime", o(), "proc", "/proc", "rw", syscall.MS_RELATIME, nil),
@@ -266,9 +307,9 @@ func (tc *mountInfoTest) check(t *testing.T, d *vfs.MountInfoDecoder, funcName s
 		})
 	} else if tc.wantNode != nil || tc.wantCollectF != nil {
 		panic("invalid test case")
-	} else if _, err := d.Unfold("/"); !errors.Is(err, tc.wantErr) {
+	} else if _, err := d.Unfold("/"); !reflect.DeepEqual(err, tc.wantErr) {
 		if tc.wantError == "" {
-			t.Errorf("Unfold: error = %v, wantErr %v",
+			t.Errorf("Unfold: error = %#v, wantErr %#v",
 				err, tc.wantErr)
 		} else if err != nil && err.Error() != tc.wantError {
 			t.Errorf("Unfold: error = %q, wantError %q",
@@ -276,9 +317,9 @@ func (tc *mountInfoTest) check(t *testing.T, d *vfs.MountInfoDecoder, funcName s
 		}
 	}
 
-	if err := gotErr(); !errors.Is(err, tc.wantErr) {
+	if err := gotErr(); !reflect.DeepEqual(err, tc.wantErr) {
 		if tc.wantError == "" {
-			t.Errorf("%s: error = %v, wantErr %v",
+			t.Errorf("%s: error = %#v, wantErr %#v",
 				funcName, err, tc.wantErr)
 		} else if err != nil && err.Error() != tc.wantError {
 			t.Errorf("%s: error = %q, wantError %q",

container/vfs/unfold.go

@@ -4,9 +4,14 @@ import (
 	"iter"
 	"path"
 	"strings"
-	"syscall"
 )
 
+type UnfoldTargetError string
+
+func (e UnfoldTargetError) Error() string {
+	return "mount point " + string(e) + " never appeared in mountinfo"
+}
+
 // MountInfoNode positions a [MountInfoEntry] in its mount hierarchy.
 type MountInfoNode struct {
 	*MountInfoEntry
@@ -65,7 +70,8 @@ func (d *MountInfoDecoder) Unfold(target string) (*MountInfoNode, error) {
 	}
 
 	if targetIndex == -1 {
-		return nil, syscall.ESTALE
+		// target does not exist in parsed mountinfo
+		return nil, &DecoderError{Op: "unfold", Line: -1, Err: UnfoldTargetError(targetClean)}
 	}
 
 	for _, cur := range mountinfo {

container/vfs/unfold_test.go

@@ -1,11 +1,9 @@
 package vfs_test
 
 import (
-	"errors"
 	"reflect"
 	"slices"
 	"strings"
-	"syscall"
 	"testing"
 
 	"hakurei.app/container/vfs"
@@ -26,7 +24,7 @@ func TestUnfold(t *testing.T) {
 			"no match",
 			sampleMountinfoBase,
 			"/mnt",
-			syscall.ESTALE, nil, nil, nil,
+			&vfs.DecoderError{Op: "unfold", Line: -1, Err: vfs.UnfoldTargetError("/mnt")}, nil, nil, nil,
 		},
 		{
 			"cover",
@@ -55,7 +53,7 @@ func TestUnfold(t *testing.T) {
 			d := vfs.NewMountInfoDecoder(strings.NewReader(tc.sample))
 			got, err := d.Unfold(tc.target)
 
-			if !errors.Is(err, tc.wantErr) {
+			if !reflect.DeepEqual(err, tc.wantErr) {
 				t.Errorf("Unfold: error = %v, wantErr %v",
 					err, tc.wantErr)
 			}

dist/install.sh

@@ -2,7 +2,7 @@
 cd "$(dirname -- "$0")" || exit 1
 
 install -vDm0755 "bin/hakurei" "${HAKUREI_INSTALL_PREFIX}/usr/bin/hakurei"
-install -vDm0755 "bin/planterette" "${HAKUREI_INSTALL_PREFIX}/usr/bin/planterette"
+install -vDm0755 "bin/hpkg" "${HAKUREI_INSTALL_PREFIX}/usr/bin/hpkg"
 
 install -vDm6511 "bin/hsu" "${HAKUREI_INSTALL_PREFIX}/usr/bin/hsu"
 if [ ! -f "${HAKUREI_INSTALL_PREFIX}/etc/hsurc" ]; then

flake.lock

@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1748665073,
-        "narHash": "sha256-RMhjnPKWtCoIIHiuR9QKD7xfsKb3agxzMfJY8V9MOew=",
+        "lastModified": 1756679287,
+        "narHash": "sha256-Xd1vOeY9ccDf5VtVK12yM0FS6qqvfUop8UQlxEB+gTQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "282e1e029cb6ab4811114fc85110613d72771dea",
+        "rev": "07fc025fe10487dd80f2ec694f1cd790e752d0e8",
         "type": "github"
       },
       "original": {
@@ -23,11 +23,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1749024892,
-        "narHash": "sha256-OGcDEz60TXQC+gVz5sdtgGJdKVYr6rwdzQKuZAJQpCA=",
+        "lastModified": 1757020766,
+        "narHash": "sha256-PLoSjHRa2bUbi1x9HoXgTx2AiuzNXs54c8omhadyvp0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "8f1b52b04f2cb6e5ead50bd28d76528a2f0380ef",
+        "rev": "fe83bbdde2ccdc2cb9573aa846abe8363f79a97a",
         "type": "github"
       },
       "original": {

flake.nix

@@ -32,7 +32,7 @@
       buildPackage = forAllSystems (
         system:
         nixpkgsFor.${system}.callPackage (
-          import ./cmd/planterette/build.nix {
+          import ./cmd/hpkg/build.nix {
             inherit
               nixpkgsFor
               system
@@ -69,7 +69,7 @@
             withRace = true;
           };
 
-          planterette = callPackage ./cmd/planterette/test { inherit system self; };
+          hpkg = callPackage ./cmd/hpkg/test { inherit system self; };
 
           formatting = runCommandLocal "check-formatting" { nativeBuildInputs = [ nixfmt-rfc-style ]; } ''
             cd ${./.}
@@ -125,7 +125,7 @@
               glibc
               xdg-dbus-proxy
 
-              # planterette
+              # hpkg
               zstd
               gnutar
               coreutils
@@ -159,6 +159,54 @@
           default = pkgs.mkShell { buildInputs = hakurei.targetPkgs; };
           withPackage = pkgs.mkShell { buildInputs = [ hakurei ] ++ hakurei.targetPkgs; };
 
+          vm =
+            let
+              nixos = nixpkgs.lib.nixosSystem {
+                inherit system;
+                modules = [
+                  {
+                    environment = {
+                      systemPackages = [
+                        (pkgs.buildFHSEnv {
+                          pname = "hakurei-fhs";
+                          inherit (hakurei) version;
+                          targetPkgs = _: hakurei.targetPkgs;
+                          extraOutputsToInstall = [ "dev" ];
+                          profile = ''
+                            export PKG_CONFIG_PATH="/usr/share/pkgconfig:$PKG_CONFIG_PATH"
+                          '';
+                        })
+                      ];
+
+                      hakurei =
+                        let
+                          # this is used for interactive vm testing during development, where tests might be broken
+                          package = self.packages.${pkgs.system}.hakurei.override {
+                            buildGoModule = previousArgs: pkgs.pkgsStatic.buildGoModule (previousArgs // { doCheck = false; });
+                          };
+                        in
+                        {
+                          inherit package;
+                          hsuPackage = self.packages.${pkgs.system}.hsu.override { hakurei = package; };
+                        };
+                    };
+                  }
+
+                  ./test/interactive/configuration.nix
+                  ./test/interactive/vm.nix
+                  ./test/interactive/hakurei.nix
+                  ./test/interactive/trace.nix
+
+                  self.nixosModules.hakurei
+                  self.inputs.home-manager.nixosModules.home-manager
+                ];
+              };
+            in
+            pkgs.mkShell {
+              buildInputs = [ nixos.config.system.build.vm ];
+              shellHook = "exec run-nixos-vm $@";
+            };
+
           generateDoc =
             let
               inherit (pkgs) lib;

helper/cmd_test.go

@@ -8,12 +8,13 @@ import (
 	"os/exec"
 	"testing"
 
+	"hakurei.app/container"
 	"hakurei.app/helper"
 )
 
 func TestCmd(t *testing.T) {
 	t.Run("start non-existent helper path", func(t *testing.T) {
-		h := helper.NewDirect(t.Context(), "/proc/nonexistent", argsWt, false, argF, nil, nil)
+		h := helper.NewDirect(t.Context(), container.Nonexistent, argsWt, false, argF, nil, nil)
 
 		if err := h.Start(); !errors.Is(err, os.ErrNotExist) {
 			t.Errorf("Start: error = %v, wantErr %v",

helper/container.go

@@ -16,7 +16,7 @@ import (
 // New initialises a Helper instance with wt as the null-terminated argument writer.
 func New(
 	ctx context.Context,
-	name string,
+	pathname *container.Absolute, name string,
 	wt io.WriterTo,
 	stat bool,
 	argF func(argsFd, statFd int) []string,
@@ -26,7 +26,7 @@ func New(
 	var args []string
 	h := new(helperContainer)
 	h.helperFiles, args = newHelperFiles(ctx, wt, stat, argF, extraFiles)
-	h.Container = container.New(ctx, name, args...)
+	h.Container = container.NewCommand(ctx, pathname, name, args...)
 	h.WaitDelay = WaitDelay
 	if cmdF != nil {
 		cmdF(h.Container)

helper/container_test.go

@@ -4,20 +4,17 @@ import (
 	"context"
 	"io"
 	"os"
-	"os/exec"
 	"testing"
 
 	"hakurei.app/container"
 	"hakurei.app/helper"
-	"hakurei.app/internal"
-	"hakurei.app/internal/hlog"
 )
 
 func TestContainer(t *testing.T) {
-	t.Run("start empty container", func(t *testing.T) {
-		h := helper.New(t.Context(), "/nonexistent", argsWt, false, argF, nil, nil)
+	t.Run("start invalid container", func(t *testing.T) {
+		h := helper.New(t.Context(), container.MustAbs(container.Nonexistent), "hakurei", argsWt, false, argF, nil, nil)
 
-		wantErr := "sandbox: starting an empty container"
+		wantErr := "container: starting an invalid container"
 		if err := h.Start(); err == nil || err.Error() != wantErr {
 			t.Errorf("Start: error = %v, wantErr %q",
 				err, wantErr)
@@ -25,7 +22,7 @@ func TestContainer(t *testing.T) {
 	})
 
 	t.Run("valid new helper nil check", func(t *testing.T) {
-		if got := helper.New(t.Context(), "hakurei", argsWt, false, argF, nil, nil); got == nil {
+		if got := helper.New(t.Context(), container.MustAbs(container.Nonexistent), "hakurei", argsWt, false, argF, nil, nil); got == nil {
 			t.Errorf("New(%q, %q) got nil",
 				argsWt, "hakurei")
 			return
@@ -34,22 +31,13 @@ func TestContainer(t *testing.T) {
 
 	t.Run("implementation compliance", func(t *testing.T) {
 		testHelper(t, func(ctx context.Context, setOutput func(stdoutP, stderrP *io.Writer), stat bool) helper.Helper {
-			return helper.New(ctx, os.Args[0], argsWt, stat, argF, func(z *container.Container) {
+			return helper.New(ctx, container.MustAbs(os.Args[0]), "helper", argsWt, stat, argF, func(z *container.Container) {
 				setOutput(&z.Stdout, &z.Stderr)
-				z.CommandContext = func(ctx context.Context) (cmd *exec.Cmd) {
-					return exec.CommandContext(ctx, os.Args[0], "-test.v",
-						"-test.run=TestHelperInit", "--", "init")
-				}
-				z.Bind("/", "/", 0).Proc("/proc").Dev("/dev")
+				z.
+					Bind(container.AbsFHSRoot, container.AbsFHSRoot, 0).
+					Proc(container.AbsFHSProc).
+					Dev(container.AbsFHSDev, true)
 			}, nil)
 		})
 	})
 }
-
-func TestHelperInit(t *testing.T) {
-	if len(os.Args) != 5 || os.Args[4] != "init" {
-		return
-	}
-	container.SetOutput(hlog.Output{})
-	container.Init(hlog.Prepare, func(bool) { internal.InstallOutput(false) })
-}

helper/helper_test.go

@@ -6,8 +6,10 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"reflect"
 	"strconv"
 	"strings"
+	"syscall"
 	"testing"
 	"time"
 
@@ -38,7 +40,6 @@ func argF(argsFd, statFd int) []string {
 
 func argFChecked(argsFd, statFd int) (args []string) {
 	args = make([]string, 0, 6)
-	args = append(args, "-test.run=TestHelperStub", "--")
 	if argsFd > -1 {
 		args = append(args, "--args", strconv.Itoa(argsFd))
 	}
@@ -48,6 +49,10 @@ func argFChecked(argsFd, statFd int) (args []string) {
 	return
 }
 
+const (
+	containerTimeout = 30 * time.Second
+)
+
 // this function tests an implementation of the helper.Helper interface
 func testHelper(t *testing.T, createHelper func(ctx context.Context, setOutput func(stdoutP, stderrP *io.Writer), stat bool) helper.Helper) {
 	oldWaitDelay := helper.WaitDelay
@@ -55,18 +60,15 @@ func testHelper(t *testing.T, createHelper func(ctx context.Context, setOutput f
 	t.Cleanup(func() { helper.WaitDelay = oldWaitDelay })
 
 	t.Run("start helper with status channel and wait", func(t *testing.T) {
-		ctx, cancel := context.WithTimeout(t.Context(), 5*time.Second)
+		ctx, cancel := context.WithTimeout(t.Context(), containerTimeout)
 		stdout := new(strings.Builder)
 		h := createHelper(ctx, func(stdoutP, stderrP *io.Writer) { *stdoutP, *stderrP = stdout, os.Stderr }, true)
 
 		t.Run("wait not yet started helper", func(t *testing.T) {
-			defer func() {
-				r := recover()
-				if r == nil {
-					t.Fatalf("Wait did not panic")
-				}
-			}()
-			panic(fmt.Sprintf("unreachable: %v", h.Wait()))
+			if err := h.Wait(); !reflect.DeepEqual(err, syscall.EINVAL) &&
+				!reflect.DeepEqual(err, errors.New("exec: not started")) {
+				t.Errorf("Wait: error = %v", err)
+			}
 		})
 
 		t.Log("starting helper stub")
@@ -109,7 +111,7 @@ func testHelper(t *testing.T, createHelper func(ctx context.Context, setOutput f
 	})
 
 	t.Run("start helper and wait", func(t *testing.T) {
-		ctx, cancel := context.WithTimeout(t.Context(), 5*time.Second)
+		ctx, cancel := context.WithTimeout(t.Context(), containerTimeout)
 		defer cancel()
 		stdout := new(strings.Builder)
 		h := createHelper(ctx, func(stdoutP, stderrP *io.Writer) { *stdoutP, *stderrP = stdout, os.Stderr }, false)

helper/stub.go

@@ -25,7 +25,7 @@ func InternalHelperStub() {
 		sp = v
 	}
 
-	genericStub(flagRestoreFiles(3, ap, sp))
+	genericStub(flagRestoreFiles(1, ap, sp))
 
 	os.Exit(0)
 }

helper/stub_test.go

@@ -1,9 +1,17 @@
 package helper_test
 
 import (
+	"os"
 	"testing"
 
+	"hakurei.app/container"
 	"hakurei.app/helper"
+	"hakurei.app/internal"
+	"hakurei.app/internal/hlog"
 )
 
-func TestHelperStub(t *testing.T) { helper.InternalHelperStub() }
+func TestMain(m *testing.M) {
+	container.TryArgv0(hlog.Output{}, hlog.Prepare, internal.InstallOutput)
+	helper.InternalHelperStub()
+	os.Exit(m.Run())
+}

hst/config.go

@@ -1,75 +1,125 @@
-// Package hst exports shared types for invoking hakurei.
 package hst
 
 import (
-	"hakurei.app/system"
+	"time"
+
+	"hakurei.app/container"
+	"hakurei.app/container/seccomp"
 	"hakurei.app/system/dbus"
 )
 
 const Tmp = "/.hakurei"
 
+var AbsTmp = container.MustAbs(Tmp)
+
 // Config is used to seal an app implementation.
-type Config struct {
-	// reverse-DNS style arbitrary identifier string from config;
-	// passed to wayland security-context-v1 as application ID
-	// and used as part of defaults in dbus session proxy
-	ID string `json:"id"`
+type (
+	Config struct {
+		// reverse-DNS style arbitrary identifier string from config;
+		// passed to wayland security-context-v1 as application ID
+		// and used as part of defaults in dbus session proxy
+		ID string `json:"id"`
 
-	// absolute path to executable file
-	Path string `json:"path,omitempty"`
-	// final args passed to container init
-	Args []string `json:"args"`
+		// absolute path to executable file
+		Path *container.Absolute `json:"path,omitempty"`
+		// final args passed to container init
+		Args []string `json:"args"`
 
-	// system services to make available in the container
-	Enablements system.Enablement `json:"enablements"`
+		// system services to make available in the container
+		Enablements *Enablements `json:"enablements,omitempty"`
 
-	// session D-Bus proxy configuration;
-	// nil makes session bus proxy assume built-in defaults
-	SessionBus *dbus.Config `json:"session_bus,omitempty"`
-	// system D-Bus proxy configuration;
-	// nil disables system bus proxy
-	SystemBus *dbus.Config `json:"system_bus,omitempty"`
-	// direct access to wayland socket; when this gets set no attempt is made to attach security-context-v1
-	// and the bare socket is mounted to the sandbox
-	DirectWayland bool `json:"direct_wayland,omitempty"`
+		// session D-Bus proxy configuration;
+		// nil makes session bus proxy assume built-in defaults
+		SessionBus *dbus.Config `json:"session_bus,omitempty"`
+		// system D-Bus proxy configuration;
+		// nil disables system bus proxy
+		SystemBus *dbus.Config `json:"system_bus,omitempty"`
+		// direct access to wayland socket; when this gets set no attempt is made to attach security-context-v1
+		// and the bare socket is mounted to the sandbox
+		DirectWayland bool `json:"direct_wayland,omitempty"`
 
-	// passwd username in container, defaults to passwd name of target uid or chronos
-	Username string `json:"username,omitempty"`
-	// absolute path to shell, empty for host shell
-	Shell string `json:"shell,omitempty"`
-	// absolute path to home directory in the init mount namespace
-	Data string `json:"data"`
-	// directory to enter and use as home in the container mount namespace, empty for Data
-	Dir string `json:"dir"`
-	// extra acl ops, dispatches before container init
-	ExtraPerms []*ExtraPermConfig `json:"extra_perms,omitempty"`
+		// passwd username in container, defaults to passwd name of target uid or chronos
+		Username string `json:"username,omitempty"`
+		// absolute path to shell
+		Shell *container.Absolute `json:"shell"`
+		// directory to enter and use as home in the container mount namespace
+		Home *container.Absolute `json:"home"`
 
-	// numerical application id, used for init user namespace credentials
-	Identity int `json:"identity"`
-	// list of supplementary groups inherited by container processes
-	Groups []string `json:"groups"`
+		// extra acl ops to perform before setuid
+		ExtraPerms []*ExtraPermConfig `json:"extra_perms,omitempty"`
 
-	// abstract container configuration baseline
-	Container *ContainerConfig `json:"container"`
-}
+		// numerical application id, used for init user namespace credentials
+		Identity int `json:"identity"`
+		// list of supplementary groups inherited by container processes
+		Groups []string `json:"groups"`
+
+		// abstract container configuration baseline
+		Container *ContainerConfig `json:"container"`
+	}
+
+	// ContainerConfig describes the container configuration baseline to which the app implementation adds upon.
+	ContainerConfig struct {
+		// container hostname
+		Hostname string `json:"hostname,omitempty"`
+
+		// duration to wait for after interrupting a container's initial process in nanoseconds;
+		// a negative value causes the container to be terminated immediately on cancellation
+		WaitDelay time.Duration `json:"wait_delay,omitempty"`
+
+		// extra seccomp flags
+		SeccompFlags seccomp.ExportFlag `json:"seccomp_flags"`
+		// extra seccomp presets
+		SeccompPresets seccomp.FilterPreset `json:"seccomp_presets"`
+		// disable project-specific filter extensions
+		SeccompCompat bool `json:"seccomp_compat,omitempty"`
+		// allow ptrace and friends
+		Devel bool `json:"devel,omitempty"`
+		// allow userns creation in container
+		Userns bool `json:"userns,omitempty"`
+		// share host net namespace
+		HostNet bool `json:"host_net,omitempty"`
+		// share abstract unix socket scope
+		HostAbstract bool `json:"host_abstract,omitempty"`
+		// allow dangerous terminal I/O
+		Tty bool `json:"tty,omitempty"`
+		// allow multiarch
+		Multiarch bool `json:"multiarch,omitempty"`
+
+		// initial process environment variables
+		Env map[string]string `json:"env"`
+		// map target user uid to privileged user uid in the user namespace;
+		// some programs fail to connect to dbus session running as a different uid,
+		// this option works around it by mapping priv-side caller uid in container
+		MapRealUID bool `json:"map_real_uid"`
+
+		// pass through all devices
+		Device bool `json:"device,omitempty"`
+		// container mount points;
+		// if the first element targets /, it is inserted early and excluded from path hiding
+		Filesystem []FilesystemConfigJSON `json:"filesystem"`
+	}
+)
 
 // ExtraPermConfig describes an acl update op.
 type ExtraPermConfig struct {
-	Ensure  bool   `json:"ensure,omitempty"`
-	Path    string `json:"path"`
-	Read    bool   `json:"r,omitempty"`
-	Write   bool   `json:"w,omitempty"`
-	Execute bool   `json:"x,omitempty"`
+	Ensure  bool                `json:"ensure,omitempty"`
+	Path    *container.Absolute `json:"path"`
+	Read    bool                `json:"r,omitempty"`
+	Write   bool                `json:"w,omitempty"`
+	Execute bool                `json:"x,omitempty"`
 }
 
 func (e *ExtraPermConfig) String() string {
-	buf := make([]byte, 0, 5+len(e.Path))
+	if e == nil || e.Path == nil {
+		return "<invalid>"
+	}
+	buf := make([]byte, 0, 5+len(e.Path.String()))
 	buf = append(buf, '-', '-', '-')
 	if e.Ensure {
 		buf = append(buf, '+')
 	}
 	buf = append(buf, ':')
-	buf = append(buf, []byte(e.Path)...)
+	buf = append(buf, []byte(e.Path.String())...)
 	if e.Read {
 		buf[0] = 'r'
 	}

hst/config_test.go

@@ -0,0 +1,35 @@
+package hst_test
+
+import (
+	"testing"
+
+	"hakurei.app/container"
+	"hakurei.app/hst"
+)
+
+func TestExtraPermConfig(t *testing.T) {
+	testCases := []struct {
+		name   string
+		config *hst.ExtraPermConfig
+		want   string
+	}{
+		{"nil", nil, "<invalid>"},
+		{"nil path", &hst.ExtraPermConfig{Path: nil}, "<invalid>"},
+		{"r", &hst.ExtraPermConfig{Path: container.AbsFHSRoot, Read: true}, "r--:/"},
+		{"r+", &hst.ExtraPermConfig{Ensure: true, Path: container.AbsFHSRoot, Read: true}, "r--+:/"},
+		{"w", &hst.ExtraPermConfig{Path: hst.AbsTmp, Write: true}, "-w-:/.hakurei"},
+		{"w+", &hst.ExtraPermConfig{Ensure: true, Path: hst.AbsTmp, Write: true}, "-w-+:/.hakurei"},
+		{"x", &hst.ExtraPermConfig{Path: container.AbsFHSRunUser, Execute: true}, "--x:/run/user/"},
+		{"x+", &hst.ExtraPermConfig{Ensure: true, Path: container.AbsFHSRunUser, Execute: true}, "--x+:/run/user/"},
+		{"rwx", &hst.ExtraPermConfig{Path: container.AbsFHSTmp, Read: true, Write: true, Execute: true}, "rwx:/tmp/"},
+		{"rwx+", &hst.ExtraPermConfig{Ensure: true, Path: container.AbsFHSTmp, Read: true, Write: true, Execute: true}, "rwx+:/tmp/"},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := tc.config.String(); got != tc.want {
+				t.Errorf("String: %q, want %q", got, tc.want)
+			}
+		})
+	}
+}

hst/container.go

@@ -1,63 +0,0 @@
-package hst
-
-import (
-	"hakurei.app/container/seccomp"
-)
-
-type (
-	// ContainerConfig describes the container configuration baseline to which the app implementation adds upon.
-	ContainerConfig struct {
-		// container hostname
-		Hostname string `json:"hostname,omitempty"`
-
-		// extra seccomp flags
-		SeccompFlags seccomp.ExportFlag `json:"seccomp_flags"`
-		// extra seccomp presets
-		SeccompPresets seccomp.FilterPreset `json:"seccomp_presets"`
-		// disable project-specific filter extensions
-		SeccompCompat bool `json:"seccomp_compat,omitempty"`
-		// allow ptrace and friends
-		Devel bool `json:"devel,omitempty"`
-		// allow userns creation in container
-		Userns bool `json:"userns,omitempty"`
-		// share host net namespace
-		Net bool `json:"net,omitempty"`
-		// allow dangerous terminal I/O
-		Tty bool `json:"tty,omitempty"`
-		// allow multiarch
-		Multiarch bool `json:"multiarch,omitempty"`
-
-		// initial process environment variables
-		Env map[string]string `json:"env"`
-		// map target user uid to privileged user uid in the user namespace
-		MapRealUID bool `json:"map_real_uid"`
-
-		// pass through all devices
-		Device bool `json:"device,omitempty"`
-		// container host filesystem bind mounts
-		Filesystem []*FilesystemConfig `json:"filesystem"`
-		// create symlinks inside container filesystem
-		Link [][2]string `json:"symlink"`
-
-		// read-only /etc directory
-		Etc string `json:"etc,omitempty"`
-		// automatically set up /etc symlinks
-		AutoEtc bool `json:"auto_etc"`
-		// cover these paths or create them if they do not already exist
-		Cover []string `json:"cover"`
-	}
-
-	// FilesystemConfig is an abstract representation of a bind mount.
-	FilesystemConfig struct {
-		// mount point in container, same as src if empty
-		Dst string `json:"dst,omitempty"`
-		// host filesystem path to make available to the container
-		Src string `json:"src"`
-		// do not mount filesystem read-only
-		Write bool `json:"write,omitempty"`
-		// do not disable device files
-		Device bool `json:"dev,omitempty"`
-		// fail if the bind mount cannot be established for any reason
-		Must bool `json:"require,omitempty"`
-	}
-)

hst/enablement.go

@@ -0,0 +1,69 @@
+package hst
+
+import (
+	"encoding/json"
+	"syscall"
+
+	"hakurei.app/system"
+)
+
+// NewEnablements returns the address of [system.Enablement] as [Enablements].
+func NewEnablements(e system.Enablement) *Enablements { return (*Enablements)(&e) }
+
+// enablementsJSON is the [json] representation of the [system.Enablement] bit field.
+type enablementsJSON struct {
+	Wayland bool `json:"wayland,omitempty"`
+	X11     bool `json:"x11,omitempty"`
+	DBus    bool `json:"dbus,omitempty"`
+	Pulse   bool `json:"pulse,omitempty"`
+}
+
+// Enablements is the [json] adapter for [system.Enablement].
+type Enablements system.Enablement
+
+// Unwrap returns the underlying [system.Enablement].
+func (e *Enablements) Unwrap() system.Enablement {
+	if e == nil {
+		return 0
+	}
+	return system.Enablement(*e)
+}
+
+func (e *Enablements) MarshalJSON() ([]byte, error) {
+	if e == nil {
+		return nil, syscall.EINVAL
+	}
+	return json.Marshal(&enablementsJSON{
+		Wayland: system.Enablement(*e)&system.EWayland != 0,
+		X11:     system.Enablement(*e)&system.EX11 != 0,
+		DBus:    system.Enablement(*e)&system.EDBus != 0,
+		Pulse:   system.Enablement(*e)&system.EPulse != 0,
+	})
+}
+
+func (e *Enablements) UnmarshalJSON(data []byte) error {
+	if e == nil {
+		return syscall.EINVAL
+	}
+
+	v := new(enablementsJSON)
+	if err := json.Unmarshal(data, &v); err != nil {
+		return err
+	}
+
+	var ve system.Enablement
+	if v.Wayland {
+		ve |= system.EWayland
+	}
+	if v.X11 {
+		ve |= system.EX11
+	}
+	if v.DBus {
+		ve |= system.EDBus
+	}
+	if v.Pulse {
+		ve |= system.EPulse
+	}
+	*e = Enablements(ve)
+	return nil
+}

hst/enablement_test.go

@@ -0,0 +1,108 @@
+package hst_test
+
+import (
+	"encoding/json"
+	"errors"
+	"syscall"
+	"testing"
+
+	"hakurei.app/hst"
+	"hakurei.app/system"
+)
+
+func TestEnablements(t *testing.T) {
+	testCases := []struct {
+		name  string
+		e     *hst.Enablements
+		data  string
+		sData string
+	}{
+		{"nil", nil, "null", `{"value":null,"magic":3236757504}`},
+		{"zero", hst.NewEnablements(0), `{}`, `{"value":{},"magic":3236757504}`},
+		{"wayland", hst.NewEnablements(system.EWayland), `{"wayland":true}`, `{"value":{"wayland":true},"magic":3236757504}`},
+		{"x11", hst.NewEnablements(system.EX11), `{"x11":true}`, `{"value":{"x11":true},"magic":3236757504}`},
+		{"dbus", hst.NewEnablements(system.EDBus), `{"dbus":true}`, `{"value":{"dbus":true},"magic":3236757504}`},
+		{"pulse", hst.NewEnablements(system.EPulse), `{"pulse":true}`, `{"value":{"pulse":true},"magic":3236757504}`},
+		{"all", hst.NewEnablements(system.EWayland | system.EX11 | system.EDBus | system.EPulse), `{"wayland":true,"x11":true,"dbus":true,"pulse":true}`, `{"value":{"wayland":true,"x11":true,"dbus":true,"pulse":true},"magic":3236757504}`},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Run("marshal", func(t *testing.T) {
+				if got, err := json.Marshal(tc.e); err != nil {
+					t.Fatalf("Marshal: error = %v", err)
+				} else if string(got) != tc.data {
+					t.Errorf("Marshal:\n%s, want\n%s", string(got), tc.data)
+				}
+
+				if got, err := json.Marshal(struct {
+					Value *hst.Enablements `json:"value"`
+					Magic int              `json:"magic"`
+				}{tc.e, syscall.MS_MGC_VAL}); err != nil {
+					t.Fatalf("Marshal: error = %v", err)
+				} else if string(got) != tc.sData {
+					t.Errorf("Marshal:\n%s, want\n%s", string(got), tc.sData)
+				}
+			})
+
+			t.Run("unmarshal", func(t *testing.T) {
+				{
+					got := new(hst.Enablements)
+					if err := json.Unmarshal([]byte(tc.data), &got); err != nil {
+						t.Fatalf("Unmarshal: error = %v", err)
+					}
+					if tc.e == nil {
+						if got != nil {
+							t.Errorf("Unmarshal: %v", got)
+						}
+					} else if *got != *tc.e {
+						t.Errorf("Unmarshal: %v, want %v", got, tc.e)
+					}
+				}
+
+				{
+					got := *(new(struct {
+						Value *hst.Enablements `json:"value"`
+						Magic int              `json:"magic"`
+					}))
+					if err := json.Unmarshal([]byte(tc.sData), &got); err != nil {
+						t.Fatalf("Unmarshal: error = %v", err)
+					}
+					if tc.e == nil {
+						if got.Value != nil {
+							t.Errorf("Unmarshal: %v", got)
+						}
+					} else if *got.Value != *tc.e {
+						t.Errorf("Unmarshal: %v, want %v", got.Value, tc.e)
+					}
+				}
+			})
+		})
+	}
+
+	t.Run("unwrap", func(t *testing.T) {
+		t.Run("nil", func(t *testing.T) {
+			if got := (*hst.Enablements)(nil).Unwrap(); got != 0 {
+				t.Errorf("Unwrap: %v", got)
+			}
+		})
+
+		t.Run("val", func(t *testing.T) {
+			if got := hst.NewEnablements(system.EWayland | system.EPulse).Unwrap(); got != system.EWayland|system.EPulse {
+				t.Errorf("Unwrap: %v", got)
+			}
+		})
+	})
+
+	t.Run("passthrough", func(t *testing.T) {
+		if _, err := (*hst.Enablements)(nil).MarshalJSON(); !errors.Is(err, syscall.EINVAL) {
+			t.Errorf("MarshalJSON: error = %v", err)
+		}
+		if err := (*hst.Enablements)(nil).UnmarshalJSON(nil); !errors.Is(err, syscall.EINVAL) {
+			t.Errorf("UnmarshalJSON: error = %v", err)
+		}
+		if err := new(hst.Enablements).UnmarshalJSON([]byte{}); err == nil {
+			t.Errorf("UnmarshalJSON: error = %v", err)
+		}
+	})
+}

hst/fs.go

@@ -0,0 +1,137 @@
+package hst
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"reflect"
+
+	"hakurei.app/container"
+)
+
+// FilesystemConfig is an abstract representation of a mount point.
+type FilesystemConfig interface {
+	// Valid returns whether the configuration is valid.
+	Valid() bool
+	// Path returns the target path in the container.
+	Path() *container.Absolute
+	// Host returns a slice of all host paths used by this operation.
+	Host() []*container.Absolute
+	// Apply appends the [container.Op] implementing this operation.
+	Apply(z *ApplyState)
+
+	fmt.Stringer
+}
+
+// ApplyState holds the address of [container.Ops] and any relevant application state.
+type ApplyState struct {
+	// AutoEtcPrefix is the prefix for [container.AutoEtcOp].
+	AutoEtcPrefix string
+
+	*container.Ops
+}
+
+var (
+	ErrFSNull = errors.New("unexpected null in mount point")
+)
+
+// FSTypeError is returned when [ContainerConfig.Filesystem] contains an entry with invalid type.
+type FSTypeError string
+
+func (f FSTypeError) Error() string { return fmt.Sprintf("invalid filesystem type %q", string(f)) }
+
+// FSImplError is returned for unsupported implementations of [FilesystemConfig].
+type FSImplError struct{ Value FilesystemConfig }
+
+func (f FSImplError) Error() string {
+	implType := reflect.TypeOf(f.Value)
+	var name string
+	for implType != nil && implType.Kind() == reflect.Ptr {
+		name += "*"
+		implType = implType.Elem()
+	}
+	if implType != nil {
+		name += implType.Name()
+	} else {
+		name += "nil"
+	}
+	return fmt.Sprintf("implementation %s not supported", name)
+}
+
+// FilesystemConfigJSON is the [json] adapter for [FilesystemConfig].
+type FilesystemConfigJSON struct{ FilesystemConfig }
+
+// Valid returns whether the [FilesystemConfigJSON] is valid.
+func (f *FilesystemConfigJSON) Valid() bool {
+	return f != nil && f.FilesystemConfig != nil && f.FilesystemConfig.Valid()
+}
+
+// fsType holds the string representation of a [FilesystemConfig]'s concrete type.
+type fsType struct {
+	Type string `json:"type"`
+}
+
+func (f *FilesystemConfigJSON) MarshalJSON() ([]byte, error) {
+	if f == nil || f.FilesystemConfig == nil {
+		return nil, ErrFSNull
+	}
+	var v any
+	switch cv := f.FilesystemConfig.(type) {
+	case *FSBind:
+		v = &struct {
+			fsType
+			*FSBind
+		}{fsType{FilesystemBind}, cv}
+
+	case *FSEphemeral:
+		v = &struct {
+			fsType
+			*FSEphemeral
+		}{fsType{FilesystemEphemeral}, cv}
+
+	case *FSOverlay:
+		v = &struct {
+			fsType
+			*FSOverlay
+		}{fsType{FilesystemOverlay}, cv}
+
+	case *FSLink:
+		v = &struct {
+			fsType
+			*FSLink
+		}{fsType{FilesystemLink}, cv}
+
+	default:
+		return nil, FSImplError{f.FilesystemConfig}
+	}
+
+	return json.Marshal(v)
+}
+
+func (f *FilesystemConfigJSON) UnmarshalJSON(data []byte) error {
+	t := new(fsType)
+	if err := json.Unmarshal(data, &t); err != nil {
+		return err
+	}
+	if t == nil {
+		return ErrFSNull
+	}
+	switch t.Type {
+	case FilesystemBind:
+		*f = FilesystemConfigJSON{new(FSBind)}
+
+	case FilesystemEphemeral:
+		*f = FilesystemConfigJSON{new(FSEphemeral)}
+
+	case FilesystemOverlay:
+		*f = FilesystemConfigJSON{new(FSOverlay)}
+
+	case FilesystemLink:
+		*f = FilesystemConfigJSON{new(FSLink)}
+
+	default:
+		return FSTypeError(t.Type)
+	}
+
+	return json.Unmarshal(data, f.FilesystemConfig)
+}