Use statically linked coreutils for OCI hook chroot execution

Replace /usr/bin/env chroot with statically linked coreutils binary to support
Kind clusters in CI where /usr/bin/env may not be available in the OCI hook
context. The OCI runtime doesn't properly set argv[0] for hooks, so coreutils
falls back to checking argv[1] for the program name ('chroot'), making this
invocation method reliable across different container environments.

- Add COREUTILS_STATIC environment variable pointing to static coreutils
- Convert HOST_MOUNT_PATH to Path object for consistent path handling
- Update NRI hook to invoke coreutils with 'chroot' as first argument

Author: Lillecarl

environments/node/default.nix

@@ -26,6 +26,7 @@ let
           env-file.variables = {
             PYTHONUNBUFFERED = "1"; # If something ends up print logging
             NIXPKGS_ALLOW_UNFREE = "1"; # Allow building anything
+            COREUTILS_STATIC = toString pkgs.pkgsStatic.coreutils;
           };
           # Umbrella service for CSI
           services.csi = {

python/nix_csi/constants.py

@@ -53,7 +53,10 @@
 
 # NRI host mount path for bind mounts (default: /var/lib/nix-csi)
 # Set via HOST_MOUNT_PATH environment variable from kubenix
-HOST_MOUNT_PATH = os.environ.get("HOST_MOUNT_PATH", "/var/lib/nix-csi")
+HOST_MOUNT_PATH = Path(os.environ.get("HOST_MOUNT_PATH", "/var/lib/nix-csi"))
+
+# Statically linked chroot binary used to execute OCI hooks from HOST_MOUNT_PATH
+COREUTILS_STATIC = Path(os.environ.get("COREUTILS_STATIC", "coreutils"))
 
 # Host /proc mounted into the daemonset for accessing container namespaces.
 # Set via HOST_PROC_PATH environment variable from kubenix.

python/nix_csi/nriplugin.py

@@ -27,6 +27,7 @@
     NRI_PLUGIN_IDX,
     NRI_PLUGIN_NAME,
     NRI_RUNTIME_SOCKET,
+    COREUTILS_STATIC,
 )
 from .nix import build_packages, get_build_args, get_closure_paths
 from .ns_mount import mount_in_container
@@ -226,9 +227,18 @@ async def CreateContainer(self, stream) -> None:
                 assert self.nri_wait_bin is not None, (
                     "nri-wait binary not found on PATH, wait hook won't be able to execute"
                 )
+                coreutils_binary = (
+                    HOST_MOUNT_PATH
+                    / COREUTILS_STATIC.relative_to("/")
+                    / "bin/coreutils"
+                )
                 hook = api_pb2.Hook(
-                    path="/usr/bin/env",  # This is POSIX
-                    args=["chroot", HOST_MOUNT_PATH, self.nri_wait_bin],
+                    path=str(coreutils_binary),
+                    args=[
+                        "chroot", # somehow this works in OCI hooks but not --coreutils-prog=chroot....
+                        str(HOST_MOUNT_PATH),
+                        self.nri_wait_bin,
+                    ],
                     env=[
                         "NRI_QUERY_SOCKET=/nix/var/nix-csi/wait-req.sock",
                         "NRI_PUB_SOCKET=/nix/var/nix-csi/wait-pub.sock",
@@ -237,9 +247,10 @@ async def CreateContainer(self, stream) -> None:
                 )
                 adjust.hooks.create_runtime.append(hook)
                 logger.info(
-                    "[CreateContainer] Injected createRuntime hook for container=%r (binary=%r)",
+                    "[CreateContainer] Injected createRuntime hook for container=%r (binary=%r) (chroot binary:%r)",
                     container_id,
                     self.nri_wait_bin,
+                    coreutils_binary,
                 )
 
                 # Spawn build task to build store paths and namespace-mount them into the container