virtiofs: add --mount-mode {unshare,direct} #10

2026-09-26T14:36:59+02:00

marvin commented

2026-09-26 14:36:59 +02:00

Adds a boco boot --mount-mode flag choosing how virtiofsd is launched per --mount share:

Modes

unshare (default, unchanged behavior): virtiofsd runs inside podman unshare with --sandbox chroot — guest UID 0 maps to the invoking user, other guest UIDs map into the subuid range.
direct: virtiofsd runs as the invoking user with --sandbox none — guest UIDs map 1:1 to host UIDs.

Motivation

Nested-virtiofs setups: when the shared directory itself lives on a virtiofs/fuse mount that rejects subuid-range UIDs (e.g. booting a VM from inside a boco VM), any guest write through the subuid mapping fails with EINVAL — which silently breaks databases (SQLite) and agent workspaces running as a non-root guest user. direct keeps the whole chain on real UIDs (guest 1000 → host 1000).

Caveats

Direct mode cannot use the chroot sandbox (unprivileged chroot() is not permitted), so it falls back to --sandbox none: served trees are not symlink-escape-protected. Documented in the module docs.

Testing

Both modes verified end-to-end with an alpine guest: file written on the host is readable through the mount, and guest writes with a non-root USER work in direct mode.
Default behavior unchanged (unshare remains the default).

Downstream

Used by the turnstone container-VM deployment: https://git.nubo.sh/hulthe/turnstone-boco (runs --mount-mode direct for its config/db/workspace shares).

Adds a `boco boot --mount-mode` flag choosing how virtiofsd is launched per `--mount` share: ## Modes - **unshare** (default, unchanged behavior): virtiofsd runs inside `podman unshare` with `--sandbox chroot` — guest UID 0 maps to the invoking user, other guest UIDs map into the subuid range. - **direct**: virtiofsd runs as the invoking user with `--sandbox none` — guest UIDs map 1:1 to host UIDs. ## Motivation Nested-virtiofs setups: when the shared directory itself lives on a virtiofs/fuse mount that rejects subuid-range UIDs (e.g. booting a VM from inside a boco VM), any guest write through the subuid mapping fails with `EINVAL` — which silently breaks databases (SQLite) and agent workspaces running as a non-root guest user. `direct` keeps the whole chain on real UIDs (guest 1000 → host 1000). ## Caveats Direct mode cannot use the chroot sandbox (unprivileged `chroot()` is not permitted), so it falls back to `--sandbox none`: served trees are **not** symlink-escape-protected. Documented in the module docs. ## Testing - Both modes verified end-to-end with an alpine guest: file written on the host is readable through the mount, and guest writes with a non-root USER work in direct mode. - Default behavior unchanged (unshare remains the default). ## Downstream Used by the turnstone container-VM deployment: https://git.nubo.sh/hulthe/turnstone-boco (runs `--mount-mode direct` for its config/db/workspace shares).

marvin added 1 commit 2026-09-26 14:36:59 +02:00

virtiofs: add --mount-mode {unshare,direct}

CI / build (pull_request) Failing after 8s

Details

1206728446

Adds a boot flag choosing how virtiofsd is launched per --mount:

- unshare (default, previous behavior): virtiofsd runs inside
  'podman unshare' with --sandbox chroot, mapping guest UIDs into
  the invoking user's subuid range.

- direct: virtiofsd runs as the invoking user with --sandbox none,
  mapping guest UIDs 1:1 to host UIDs.

The direct mode is needed when the shared directory itself lives on
a virtiofs/fuse mount that rejects subuid-range UIDs (e.g. nested
boco): guest writes through the subuid mapping then fail with
EINVAL, breaking anything that writes to shares as a non-root guest
user (databases, agent workspaces).

Direct mode also cannot use the chroot sandbox (unprivileged
chroot() is not permitted), so it falls back to --sandbox none;
served trees are then not symlink-escape-protected.

Verified both modes boot and serve mounts (alpine guest).

Some required checks failed

CI / build (pull_request) Failing after 8s

Details

This pull request has changes conflicting with the target branch.

src/qemu.rs

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin feat/virtiofs-mount-mode:feat/virtiofs-mount-mode

git checkout feat/virtiofs-mount-mode

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: hulthe/boco#10