lkml.org 
[lkml]   [2011]   [Dec]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: chroot(2) and bind mounts as non-root
    From
    Date
    On Wed, 2011-12-07 at 14:36 -0500, John Stoffel wrote:
    > >>>>> "Colin" == Colin Walters <walters@verbum.org> writes:
    >
    > Colin> I've recently been doing some work in software compilation, and it'd be
    > Colin> really handy if I could call chroot(2) as a non-root user. The reason
    > Colin> to chroot is to help avoid "host contamination" - I can set up a build
    > Colin> root and then chroot in. The reason to do it as non-root is, well,
    > Colin> requiring root to build software sucks for multiple obvious reasons.
    >
    > What's wrong with using 'fakeroot' or tools like that instead?

    I assume you mean
    "fakechroot" ( https://github.com/fakechroot/fakechroot/wiki )

    The answer is twofold:

    1) It's a pile of gross hacks that can easily be buggy, and will be
    permanently trying to keep up with newer system calls.
    2) It's slower. My edit-compile-debug cycle REALLY matters to me. If
    you're a developer, it should matter to you - it directly impacts your
    productivity.

    How much slower? Okay, well I tried "fakechroot" from Fedora 15. It
    appears to break parallel make. Which obviously already disqualifies it
    from being a core part of my edit-compile-debug cycle.

    But here's an example of a small autotools (~6000 significant lines of
    C) project, of which running configure is by far the slowest part. Note
    'metabuild' is a trivial script which wraps the
    'autogen.sh;configure;make' dance:

    $ metabuild # to prime the caches
    ...
    $ git clean -dfx
    ...
    $ time ostbuild-user-chroot --unshare-ipc --unshare-pid --unshare-net
    --mount-bind /src /src --mount-proc /proc
    --mount-bind /dev /dev / /bin/sh -c 'cd /src/test-project; metabuild'
    ...
    real 0m17.627s
    user 0m9.397s
    sys 0m5.074s
    $ git clean -dfx
    ...
    $ time fakeroot fakechroot chroot / /bin/sh -c 'cd /src/test-project;
    metabuild -j 1'
    real 0m35.327s
    user 0m13.118s
    sys 0m10.639s

    So it almost exactly doubles...Oh, crap, I just remembered I have
    ccache, so we're really only timing configure runs here. Anyways, you
    get the point. Doubling my compile time is bad. And this is a
    relatively small project.

    One of the best parts of Linux is the filesystem and VFS - it's really
    amazingly fast compared to other OSes, especially if you know how to use
    it. Adding in layers of emulation and crap in between the program and
    the filesystem takes that away.




    \
     
     \ /
      Last update: 2011-12-08 17:13    [W:6.816 / U:0.136 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site