Skip to content

perf(orchestrator): replace ip netns exec with nsenter to halve mount namespace copies on sandbox startup #3037

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
AdaAibaby wants to merge 10 commits into
base: main
Choose a base branch
from
+298 −20
Open

perf(orchestrator): replace ip netns exec with nsenter to halve mount namespace copies on sandbox startup #3037

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
6792b8f
perf(orchestrator): replace ip-netns-exec with nsenter to halve mount…
adababys Jun 18, 2026
b4e2f25
Merge branch 'main' into perf/replace-ip-netns-exec-with-nsenter
AdaAibaby Jun 18, 2026
7cc9b66
test(orchestrator): replace Chinese comments with English in script_b…
adababys Jun 18, 2026
b599f7a
fix(orchestrator): resolve rebase merge artifact in process.go
adababys Jun 18, 2026
f0d2cb1
Merge branch 'main' into perf/replace-ip-netns-exec-with-nsenter
AdaAibaby Jul 1, 2026
a33669b
fix(orchestrator): use Unshareflags instead of Cloneflags for CLONE_N…
adababys Jul 1, 2026
7297ac9
Merge branch 'main' into perf/replace-ip-netns-exec-with-nsenter
AdaAibaby Jul 2, 2026
5b55eed
fix(fc): clarify CLONE_NEWNS does not auto-set MS_PRIVATE; document m…
adababys Jul 3, 2026
0aa2d70
refactor(fc): reuse network.NetNamespacesDir constant and add benchmarks
adababys Jul 16, 2026
a11db38
Merge branch 'main' into perf/replace-ip-netns-exec-with-nsenter
AdaAibaby Jul 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 10 additions & 11 deletions packages/orchestrator/pkg/sandbox/fc/process.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -193,15 +193,20 @@ func NewProcess(
}

cmd := exec.CommandContext(execCtx,
"unshare",
"-m",
"--",
"bash",
"-c",
startScript.Value,
)

p := &Process{
cmd.SysProcAttr = &syscall.SysProcAttr{
Setsid: true, // Create a new session
Unshareflags: syscall.CLONE_NEWNS, // Create a new mount namespace.
// Note: unlike `unshare -m` (util-linux >= 2.27), CLONE_NEWNS does NOT automatically
// set MS_PRIVATE propagation. Private isolation is ensured by `mount --make-rprivate /`
// as the first command in both startScriptV1 and startScriptV2.
}

return &Process{
Versions: versions,
Exit: utils.NewErrorOnce(),
cmd: cmd,
Expand All @@ -215,13 +220,7 @@ func NewProcess(

kernelPath: startScript.KernelPath,
rootfsPath: startScript.RootfsPath,
}

cmd.SysProcAttr = &syscall.SysProcAttr{
Setsid: true, // Create a new session
}

return p, nil
}, nil
}

func (p *Process) configure(
Expand Down
14 changes: 10 additions & 4 deletions packages/orchestrator/pkg/sandbox/fc/script_builder.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ import (

"github.com/e2b-dev/infra/packages/orchestrator/pkg/cfg"
"github.com/e2b-dev/infra/packages/orchestrator/pkg/sandbox/artifact"
"github.com/e2b-dev/infra/packages/orchestrator/pkg/sandbox/network"
"github.com/e2b-dev/infra/packages/shared/pkg/storage"
)

Expand All @@ -25,7 +26,7 @@ type startScriptArgs struct {
DeprecatedSandboxRootfsDir string
SandboxRootfsFile string

NamespaceID string
NetNamespacePath string
FirecrackerPath string
FirecrackerSocket string
}
Expand All @@ -42,6 +43,11 @@ type StartScriptResult struct {
KernelPath string
}

// startScriptV1 and startScriptV2 begin with `mount --make-rprivate /` to recursively
// set MS_PRIVATE on all inherited mount points. This is the explicit equivalent of what
// `unshare -m` (util-linux >= 2.27) does automatically before exec. Without this step,
// the new mount namespace created by CLONE_NEWNS would still inherit shared propagation
// from the parent (verified: 80 shared mount points on this host without it, 0 after).
const startScriptV1 = `mount --make-rprivate / &&

mount -t tmpfs tmpfs {{ .DeprecatedSandboxRootfsDir }} -o X-mount.mkdir &&
Expand All @@ -50,7 +56,7 @@ ln -s {{ .HostRootfsPath }} {{ .DeprecatedSandboxRootfsDir }}/{{ .SandboxRootfsF
mount -t tmpfs tmpfs {{ .SandboxDir }}/{{ .SandboxKernelDir }} -o X-mount.mkdir &&
ln -s {{ .HostKernelPath }} {{ .SandboxDir }}/{{ .SandboxKernelDir }}/{{ .SandboxKernelFile }} &&

ip netns exec {{ .NamespaceID }} {{ .FirecrackerPath }} --api-sock {{ .FirecrackerSocket }}`
nsenter --net={{ .NetNamespacePath }} -- {{ .FirecrackerPath }} --api-sock {{ .FirecrackerSocket }}`

const startScriptV2 = `mount --make-rprivate / &&
mount -t tmpfs tmpfs {{ .SandboxDir }} -o X-mount.mkdir &&
Expand All @@ -60,7 +66,7 @@ ln -s {{ .HostRootfsPath }} {{ .SandboxDir }}/{{ .SandboxRootfsFile }} &&
mkdir -p {{ .SandboxDir }}/{{ .SandboxKernelDir }} &&
ln -s {{ .HostKernelPath }} {{ .SandboxDir }}/{{ .SandboxKernelDir }}/{{ .SandboxKernelFile }} &&

ip netns exec {{ .NamespaceID }} {{ .FirecrackerPath }} --api-sock {{ .FirecrackerSocket }}`
nsenter --net={{ .NetNamespacePath }} -- {{ .FirecrackerPath }} --api-sock {{ .FirecrackerSocket }}`

// StartScriptBuilder handles the creation and execution of firecracker start scripts
type StartScriptBuilder struct {
Expand Down Expand Up @@ -103,7 +109,7 @@ func (sb *StartScriptBuilder) buildArgs(
SandboxRootfsFile: artifact.RootfsFileName,

// FC
NamespaceID: namespaceID,
NetNamespacePath: filepath.Join(network.NetNamespacesDir, namespaceID),
FirecrackerPath: versions.FirecrackerPath(sb.builderConfig),
FirecrackerSocket: files.SandboxFirecrackerSocketPath(),
}
Expand Down
Loading