2026-10-03 00:43:08 -04:00
|
|
|
#!/usr/bin/env bash
|
|
|
|
|
# runs as root inside the netns + a private mount ns; drops privs, execs cmd.
|
|
|
|
|
set -euo pipefail
|
2026-10-03 01:48:33 -04:00
|
|
|
# /etc/resolv.conf is a symlink to the systemd stub (127.0.0.53, unreachable
|
|
|
|
|
# in the netns). Replace with a real file (private mount ns) so bwrap
|
|
|
|
|
# children see the fix too: bwrap's --ro-bind /etc is non-recursive and
|
|
|
|
|
# cannot bind over a dangling symlink.
|
|
|
|
|
rm -f /etc/resolv.conf
|
|
|
|
|
cp "$NETVM_RESOLV" /etc/resolv.conf
|
2026-10-03 00:43:08 -04:00
|
|
|
exec setpriv --reuid="$NETVM_UID" --regid="$NETVM_GID" --clear-groups \
|
|
|
|
|
env HOME="$NETVM_HOME" "$@"
|
