Skip to content

Draft: pv-runtime: Don't force creation of a tmpfs for ld.so

Simon McVittie requested to merge wip/sr640 into main

Beta releases since early December moved the temporary ld.so from /run/pressure-vessel/ldso to /var/pressure-vessel/ldso, for better interoperability with FEX-Emu (steamrt/task#342). Unfortunately, the AppArmor profile in Canonical's unofficial packaging of Steam as a Snap app only allows mounting a tmpfs at the old location, and not at the new location.

Because the root filesystem of the bubblewrap container is itself a tmpfs, and we don't share /var with the host (if we did, creating /var/pressure-vessel would fail anyway, because we're not root), we can assume that /var and /var/pressure-vessel are on the same tmpfs, and therefore avoid any need to mount it explicitly, working around the AppArmor profile being overly specific.

Helps: https://github.com/ValveSoftware/steam-runtime/issues/640
Mitigates: https://github.com/canonical/steam-snap/issues/356

This actually doesn't help as much as I'd hoped: the error message for the tmpfs is merely the first one. snapd also doesn't allow bind-mounts into locations that it doesn't expect, and that is not something we can avoid, unless we add complexity to pressure-vessel by detecting a snapd environment and using a different container layout (ugh).

I think the real solution to this is for snapd to stop assuming that Steam's behaviour will never change. https://github.com/snapcore/snapd/pull/13489 is a small step in the right direction (although tbh not really enough).

/cc @denittis

Merge request reports