NetVM: 1:1 profile:node mapping — hashed iface names, netvm-enter + netvm-chrome launcher

bin/netvm-enter.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# netvm-enter.sh <node> <uid> <gid> <home> -- <cmd> [args...]
+# Enter the node's netns, bind a working resolv.conf (host uses the
+# systemd-resolved stub 127.0.0.53, unreachable in the netns), drop
+# privileges, exec the command. Run as root (sudo -n via the allowlist).
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+. "$SCRIPT_DIR/netvm-names.sh"
+netvm_names "$1"; TUID="$2"; TGID="$3"; THOME="$4"; shift 4
+[ "${1:-}" = "--" ]; shift
+RESOLV=/etc/netvm/resolv-warp.conf
+[ -f "$RESOLV" ] || echo "nameserver 1.1.1.1" > "$RESOLV"
+ip netns exec "$NETNS" env \
+  NETVM_RESOLV="$RESOLV" NETVM_UID="$TUID" NETVM_GID="$TGID" NETVM_HOME="$THOME" \
+  unshare --mount "$SCRIPT_DIR/netvm-enter-inner.sh" "$@"