Messages in this thread | | | Subject | Re: chroot(2) and bind mounts as non-root | From | Colin Walters <> | Date | Thu, 08 Dec 2011 11:10:52 -0500 |
| |
On Wed, 2011-12-07 at 14:36 -0500, John Stoffel wrote: > >>>>> "Colin" == Colin Walters <walters@verbum.org> writes: > > Colin> I've recently been doing some work in software compilation, and it'd be > Colin> really handy if I could call chroot(2) as a non-root user. The reason > Colin> to chroot is to help avoid "host contamination" - I can set up a build > Colin> root and then chroot in. The reason to do it as non-root is, well, > Colin> requiring root to build software sucks for multiple obvious reasons. > > What's wrong with using 'fakeroot' or tools like that instead?
I assume you mean "fakechroot" ( https://github.com/fakechroot/fakechroot/wiki )
The answer is twofold:
1) It's a pile of gross hacks that can easily be buggy, and will be permanently trying to keep up with newer system calls. 2) It's slower. My edit-compile-debug cycle REALLY matters to me. If you're a developer, it should matter to you - it directly impacts your productivity.
How much slower? Okay, well I tried "fakechroot" from Fedora 15. It appears to break parallel make. Which obviously already disqualifies it from being a core part of my edit-compile-debug cycle.
But here's an example of a small autotools (~6000 significant lines of C) project, of which running configure is by far the slowest part. Note 'metabuild' is a trivial script which wraps the 'autogen.sh;configure;make' dance:
$ metabuild # to prime the caches ... $ git clean -dfx ... $ time ostbuild-user-chroot --unshare-ipc --unshare-pid --unshare-net --mount-bind /src /src --mount-proc /proc --mount-bind /dev /dev / /bin/sh -c 'cd /src/test-project; metabuild' ... real 0m17.627s user 0m9.397s sys 0m5.074s $ git clean -dfx ... $ time fakeroot fakechroot chroot / /bin/sh -c 'cd /src/test-project; metabuild -j 1' real 0m35.327s user 0m13.118s sys 0m10.639s
So it almost exactly doubles...Oh, crap, I just remembered I have ccache, so we're really only timing configure runs here. Anyways, you get the point. Doubling my compile time is bad. And this is a relatively small project.
One of the best parts of Linux is the filesystem and VFS - it's really amazingly fast compared to other OSes, especially if you know how to use it. Adding in layers of emulation and crap in between the program and the filesystem takes that away.
| |