#!/usr/bin/env bash
# runs as root inside the netns + a private mount ns; drops privs, execs cmd.
set -euo pipefail
# /etc/resolv.conf is a symlink to the systemd stub (127.0.0.53, unreachable
# in the netns). Replace with a real file (private mount ns) so bwrap
# children see the fix too: bwrap's --ro-bind /etc is non-recursive and
# cannot bind over a dangling symlink.
rm -f /etc/resolv.conf
cp "$NETVM_RESOLV" /etc/resolv.conf
exec setpriv --reuid="$NETVM_UID" --regid="$NETVM_GID" --clear-groups \
  env HOME="$NETVM_HOME" "$@"