go install go.sbk.wtf/runj/cmd/runj-entrypoint@latest
runj-entrypoint is a small helper program for starting processes inside OCI jails. This program is used for ensuring that the jail process's STDIO is hooked up to the right STDIO streams.
When used for the jail's init process, the STDIO streams should match that of `runj create`. In this scenario, this program is started when `runj create` is invoked, but blocks until `runj start` is invoked.
Unfortunately, this program works through indirection that is not obvious. When `runj create` is run, it creates a fifo (see mkfifo(2)) and then starts this program, passing the jail ID, the path to the fifo, and the program that should be invoked as arguments. This program then opens the fifo for writing, which should block to wait for the right time to actually exec into the target program. `runj start` will open the fifo for reading, which unblocks this program and the jail process can start.
The above procedure is skipped when secondary processes are started, since there is no create/start split involved for these processes and the STDIO of `runj extension exec` is used directly.
This program exec(2)s to into the final target program. The sequence of exec(2)` preserves the PID so that it can be the target of a future invocation of `runj kill`.
Process attributes that must be applied from inside the jail (currently the working directory; in the future the user, umask, rlimits, and so on) are not passed on this program's command line or environment. Instead this program reads them back from the container's state directory: from the persisted config.json for the jail's init process, or from a per-pid file written by `runj exec` for a secondary process. See docs/entrypoint-process-config.md for the rationale.
const MaxNameLen = 4096
MaxSendfdLen is the maximum length of the name of a file descriptor being sent using SendFd. The name of the file handle returned by RecvFd will never be larger than this value.
RecvFd waits for a file descriptor to be sent over the given AF_UNIX socket. The file name of the remote file descriptor will be recreated locally (it is sent as non-auxiliary data in the same payload).
SendFd sends a file descriptor over the given AF_UNIX socket. In addition, the file.Name() of the given file will also be sent as non-auxiliary data in the same payload (allowing to send contextual information for a file descriptor).