Why does rootless nerdctl run two times of main()?

[ningziwen]

I changed one line ./cmd/nerdctl/main.go to add log for starting main.

func main() {
	logrus.Info("Start main")
	if err := xmain(); err != nil {
		HandleExitCoder(err)
		logrus.Fatal(err)
	}
}

Then if I run rootless nerdctl, it will print two times.

Admin:~/nerdctl (master) $ ./_output/nerdctl run  -it public.ecr.aws/amazonlinux/amazonlinux:2 bash
INFO[0000] Start main                                   
INFO[0000] Start main 

The rootful nerdctl only prints it for one time.

Admin:~/nerdctl (master) $ sudo ./_output/nerdctl run  -it public.ecr.aws/amazonlinux/amazonlinux:2 bash                                                                                                                 
INFO[0000] Start main

[AkihiroSuda]

To enter the namespaces.

nerdctl/cmd/nerdctl/main.go

Lines 229 to 232 in bb7bba5

	if appNeedsRootlessParentMain(cmd, args) {
	// reexec /proc/self/exe with `nsenter` into RootlessKit namespaces
	return rootlessutil.ParentMain()
	}

(Without this, nsentering to userns isn't possible with Go AFAICS due to threading)

[fahedouch]

	args := []string{
		"-r/",     // root dir (busybox nsenter wants this to be explicitly specified),
		"-w" + wd, // work dir
		"--preserve-credentials",
		"-m", "-n", "-U",
		"-t", strconv.Itoa(childPid),
		"-F", // no fork

@AkihiroSuda

why are we entering to mount, network and user ns but NOT pid namespace.

Other question: how this entrering is handled in the case of rootfull mode ? ( you can answer me by providing me a link or simple phrase ;) )

[AkihiroSuda]

why are we entering to mount, network and user ns but NOT pid namespace.

Because PID namespace is not unshared.
UserNS, MountNS, and NetNS are unshared to gain the fake privileges inside it.

Other question: how this entrering is handled in the case of rootfull mode ? ( you can answer me by providing me a link or simple phrase ;) )

Entering is not needed for rootful because no namespace is unshared.

[fahedouch]

Because PID namespace is not unshared.
UserNS, MountNS, and NetNS are unshared to gain the fake privileges inside it.

got the point, the idea is to make a fake user/net ns for the rootless user

Entering is not needed for rootful because no namespace is unshared.

So are they cloned or forked to ensure isolation ?

[ningziwen]

// reexec /proc/self/exe with `nsenter` into RootlessKit namespaces 

This comment makes sense to me. Executing self should go back to main.

But based on the args of nsenter, I didn't find the logic of executing /proc/self/exe? Did I miss anything?

[AkihiroSuda]

Looks like we are just using os.Args[0] as the self exe

nerdctl/pkg/rootlessutil/parent.go

Line 99 in 2e5cdac

args = append(args, os.Args...)