I’ve been messing around with setting up simple containers using LXC.
Then I wanted to know: how do I add my home directory (readonly) into
a container so I can install software from there? The only way I could
find was: 1) stop the container 2) modify the config to add a mount
entry for the new directory, and 3) restart the container.

Surely there has to be a way to do a mount across namespaces? But no:
you can enter the container’s filesystem namespace, but once there,
you cannot see the directory you want to make visible in there. There
is no option, in the bind-mount function, to specify separate
namespaces for the source and destination directories.

Then it turns out the LXD folks had been thinking about this exact
same problem
<https://people.kernel.org/brauner/mounting-into-mount-namespaces>.
They initially came up with a mechanism they called “mount namespace
tunnels”, specifically to allow this sort of operation.

LXC is of course much more basic than LXD. But that blog post has
given me some ideas about possible ways to do it without having some
special mechanism set up beforehand.

But it turns out, the Linux kernel itself has added a much more
advanced filesystem-mount API, which can be used to do this kind of
thing. Oddly, the man pages for these additional system calls are
missing from the current version of Debian. But they can be found
online. The calls themselves are defined in <sys/mount.h>.

Lawrence D'Oliveiro wrote:

> how do I add my home directory (readonly) into
> a container so I can install software from there?

fish:// or sshfs ?

On 12/23/24 00:54, Lawrence D'Oliveiro wrote:
> I’ve been messing around with setting up simple containers using LXC.
> Then I wanted to know: how do I add my home directory (readonly) into
> a container so I can install software from there? The only way I could
> find was: 1) stop the container 2) modify the config to add a mount
> entry for the new directory, and 3) restart the container.
>

I don't know LCX, but in Docker containers the idea is that you have
script/config files to specify the container, and you start from those,
as opposed to setting up your environment, iteratively, in a long lived
container that is persisted between sessions. In effect the development
cycle is that you make iterative changes to the container definition
files and restart for every change.

It is a slightly different way of thinking, but starting and stopping
containers is normally quick and having scripted provisioning is a huge
advantage in that it becomes much easier to understand/test/reproduce
any container environment. Professionally, I have wasted so much time,
understanding environment differences, changes that are made and
forgotten. I loved having environments that I can reproduce, tear down,
rebuild, test.

It seems quite easy to mount your home folder, or any folder, when
starting the container, so why not just do that? Go with the flow,
rather than seek to preserve development behaviour from previous
development environments.

Yes, you can search the web and find people who have a genuine specific
niche reason to do it the old way, but check you really need to do it,
rather than adapt and go with the intended way of working with containers.

On Mon, 23 Dec 2024, Andy Burns wrote:

> Lawrence D'Oliveiro wrote:
>
>> how do I add my home directory (readonly) into
>> a container so I can install software from there?
>
> fish:// or sshfs ?
>
>

https://www.baeldung.com/linux/docker-mount-host-filesystem ?