Support volume mounting?

[arianvp]

Are there plans to support volume mounting?

We could create a mount namespace with unshare and then expose mounts to the mount namespace

[tgross]

The exec2 driver is built around Landlock for filesystem isolation so that you don't need to bring a root filesystem along (as with OCI containers). Using a mount namespace would require significant redesign, as you then have to figure out where the root filesystem is coming from. Maybe we could just bind-mount / to the mount namespace?

A mount namespace would also help us resolve the problem with DNS described in #48 so this is definitely something we might want to consider.

[arianvp]

I think that's also what systemd does

It sets up a mount namespace for each service. Usually mounts /usr read-only (if you have protect system on)

And you can bind mount extra paths with

https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#BindPaths=