box/bin/netvm-enter-inner.sh

#!/usr/bin/env bash
# runs as root inside the netns + a private mount ns; drops privs, execs cmd.
set -euo pipefail
# /etc/resolv.conf is a symlink to the systemd stub (127.0.0.53, unreachable
# in the netns). Replace with a real file (private mount ns) so bwrap
# children see the fix too: bwrap's --ro-bind /etc is non-recursive and
mount --make-rprivate / 2>/dev/null || true
if [ -L /etc/resolv.conf ] || ! cmp -s "$NETVM_RESOLV" /etc/resolv.conf 2>/dev/null; then
  TMP="/etc/resolv.conf.netvm.$$"
  if cp -f "$NETVM_RESOLV" "$TMP" 2>/dev/null; then
    mv -f "$TMP" /etc/resolv.conf 2>/dev/null || rm -f "$TMP" 2>/dev/null || true
  fi
fi

exec setpriv --reuid="$NETVM_UID" --regid="$NETVM_GID" --clear-groups \
  env HOME="$NETVM_HOME" "$@"