Adel Zaalouk bec39d9594 fix(sandbox): undo tmpfs overlay when setns fails during SPIFFE mount namespace setup ...

On OpenShift and other container runtimes that do not grant
CAP_SYS_ADMIN, setns(CLONE_NEWNS) fails with EPERM after
create_supervisor_identity_mount_namespace has already mounted
an empty tmpfs over the SPIFFE workload API socket directory.
PID 1 remains stuck in the new mount namespace where the tmpfs
hides the socket, making it invisible to all processes.

Fix: when setns() fails, call umount2(MNT_DETACH) to remove
the tmpfs overlay before returning the error, so the SPIFFE
socket stays accessible even without namespace isolation.

Also wire up prepare_supervisor_identity_mount_namespace_from_env
in main.rs and make it gracefully degrade on error instead of
aborting the supervisor.

Signed-off-by: Adel Zaalouk <azaalouk@redhat.com>

2026-07-08 15:27:55 +02:00

..

src

fix(sandbox): undo tmpfs overlay when setns fails during SPIFFE mount namespace setup

2026-07-08 15:27:55 +02:00

tests

refactor(openshell-sandbox): Split sandbox into process and network subcrates. (#1650)

2026-06-15 15:16:23 -04:00

Cargo.toml

refactor(openshell-sandbox): Split sandbox into process and network subcrates. (#1650)

2026-06-15 15:16:23 -04:00