A careful examination of the container-detect job shows that switching it to virtual-filesystems would also result in a race condition. The job has two functions:
- emitting an event telling whether we're in a container or not
- populating /run/container_type
The first function is race-free by definition. The second would be racy because the file is consumed by /bin/running-in-container, which is in turn used by /lib/init/apparmor-profile-load, needed by several other upstart jobs to determine whether the apparmor profile needs to be loaded. In the non-container case there's no problem; in the container case, there's a race because these jobs may be started in parallel to the virtual-filesystems processing, check for /run/container_type before it's written, and fail to start because of an apparmor failure.
So unfortunately I don't think we can change this. Instead, this devolves into bug #1031065 / bug #643289, which would also solve this problem once the MOUNTPOINT=/ event was not blocking the MOUNTPOINT=/run event from happening in parallel.
A careful examination of the container-detect job shows that switching it to virtual-filesystems would also result in a race condition. The job has two functions:
- emitting an event telling whether we're in a container or not
- populating /run/container_type
The first function is race-free by definition. The second would be racy because the file is consumed by /bin/running- in-container, which is in turn used by /lib/init/ apparmor- profile- load, needed by several other upstart jobs to determine whether the apparmor profile needs to be loaded. In the non-container case there's no problem; in the container case, there's a race because these jobs may be started in parallel to the virtual-filesystems processing, check for /run/container_type before it's written, and fail to start because of an apparmor failure.
So unfortunately I don't think we can change this. Instead, this devolves into bug #1031065 / bug #643289, which would also solve this problem once the MOUNTPOINT=/ event was not blocking the MOUNTPOINT=/run event from happening in parallel.