Check for overlay kernel module

Artifacts.toml

@@ -15,12 +15,12 @@ lazy = true
     url = "https://github.com/staticfloat/Sandbox.jl/releases/download/julia-python3-77eae3ba/julia-python3.tar.gz"
 
 [debian-minimal-rootfs]
-git-tree-sha1 = "9d17b0cec25aa5d954a7793cb4814a21f24a05e4"
+git-tree-sha1 = "f2dd967ccbf4ab29781388f5848f8d17a4a4e0bc"
 lazy = true
 
     [[debian-minimal-rootfs.download]]
-    sha256 = "72d1716f9957a9bd50beff2f66fe5fbd7482f67ee79435f89e6e972181e3bf92"
-    url = "https://github.com/JuliaCI/rootfs-images/releases/download/v3.9/debian_minimal.x86_64.tar.gz"
+    sha256 = "7e5f2625e6ca9a105430e0a505896184b503dfc3a7ce15916d2b8dca0391e65d"
+    url = "https://github.com/JuliaCI/rootfs-images/releases/download/v4.4/debian_minimal.x86_64.tar.gz"
 
 [julia-alpine-rootfs]
 git-tree-sha1 = "2a09164e817e43448ff352b34e601f5446e8be7e"

src/UserNamespaces.jl

@@ -67,6 +67,7 @@ function executor_available(::Type{T}; verbose::Bool=false) where {T <: UserName
     end
     return with_executor(T) do exe
         return check_kernel_version(;verbose) &&
+               check_overlayfs_loaded(;verbose) &&
                probe_executor(exe; test_read_only_map=true, test_read_write_map=true, verbose)
     end
 end
@@ -86,9 +87,7 @@ function check_kernel_version(;verbose::Bool = false)
 
     # Otherwise, we have a kernel version and if it's too old, we should freak out.
     if kernel_version < v"3.18"
-        if verbose
-            @warn("Kernel version too old: detected $(kernel_version), need at least 3.18!")
-        end
+        @warn("Kernel version too old: detected $(kernel_version), need at least 3.18!")
         return false
     end
 
@@ -98,7 +97,34 @@ function check_kernel_version(;verbose::Bool = false)
     return true
 end
 
+function check_overlayfs_loaded(;verbose::Bool = false)
+    if !Sys.islinux()
+        return false
+    end
+
+    # If the user has disabled this check, return `true`
+    if parse(Bool, get(ENV, "SANDBOX_SKIP_OVERLAYFS_CHECK", "false"))
+        return true
+    end
+
+    mods = get_loaded_modules()
+    if verbose
+        @info("Found $(length(mods)) loaded modules")
+    end
 
+    filter!(mods) do (name, size, count, deps, state, addr)
+        return name == "overlay"
+    end
+    if isempty(mods)
+        @warn("Could not find loaded `overlay` module, try `sudo modprobe overlay` or export SANDBOX_SKIP_OVERLAYFS_CHECK=true to disable this check!")
+        return false
+    end
+
+    if verbose
+        @info("Found loaded `overlay` module")
+    end
+    return true
+end
 
 function build_executor_command(exe::UserNamespacesExecutor, config::SandboxConfig, user_cmd::Cmd)
     # While we would usually prefer to use the `executable_product()` function to get a

src/utils.jl

@@ -165,6 +165,25 @@ function get_kernel_version(;verbose::Bool = false)
     return nothing
 end
 
+"""
+    get_loaded_modules()
+
+Returns a list of modules currently loaded by the system.  On non-Linux platforms,
+returns an empty list.
+"""
+function get_loaded_modules()
+    try
+        filter!(split.(readlines("/proc/modules"))) do (name, size, count, deps, state, addr)
+            return state == "Live"
+        end
+    catch e
+        if isa(e, SystemError)
+            return Vector{String}[]
+        end
+        rethrow(e)
+    end
+end
+
 """
     getuid()