Consider disabling user namespaces by default to improve Proton debugging experience
Currently, the container based runtime creates a new user namespace, probably to provide more isolation. I'm not aware of a way to disable this (if kernel.unprivileged_userns_clone=0
then the runtime will refuse to launch).
However, this can interfere with very specific debugging cases in Proton, when wineserver was launched inside the container but apps are manually launched from outside (using scripts generated by PROTON_DUMP_DEBUG_COMMANDS
), then attempts to attach Win32 debuggers to the respective app will be refused. This is because all debugging requests go through wineserver. Since wineserver runs in the less privileged user namespace, it's unable to do ptrace calls against a process that was launched outside that.
In my case, I'm trying to attach a manually launched debugger to manually launched debugger, because the first one gets deadlocked when the game process crashes
Other potential use cases include re-launching the game from an externally attached debugger. This effectively re-parents the game process, which gives you the same problem wrt ptrace privileges.
I wonder if disabling user namespaces by default is a viable solution to this problem (not sure if they are an essential part of containerization). If this is deemed wontfix, I'm fine with disabling the container runtime manually for now, and maybe in the future we could fix the debug scripts to properly launch things in the same container context.