8 ms·

The chroot Technique – a Swiss army multitool for Linux systems

301 points by mariuz 2y ago

smallpipe 2y ago
The arch linux install has a little wrapper around chroot, used to configure the installed system without booting it. https://wiki.archlinux.org/title/Installation_guide#Chroot https://wiki.archlinux.org/title/Installation_guide#Chroot
- znpy 2y ago
  Gentoo’s stage3 would like to say a word
  - slicktux 2y ago
    I remember first installing Gentoo…printed the whole manual and followed along. After a failed attempt and second successful install I learned enough to know that I could use a LiveUSB of my choosing and chroot into the install. Good times!
    - adrian_b 2y ago
      On Gentoo, it is also simple to install a completely new system in a chroot environment, even if it is intended for a computer with a different, but compatible architecture. This is frequently very convenient if you want to install Gentoo by compiling everything from sources on a cheap and small computer, e.g. one with some Intel Atom CPU. Instead of compiling anything on the resource-constrained computer, you install a fresh Gentoo system for it, in a chroot environment on a fast desktop computer, which supports a superset of the ISA of the small computer, so you can still execute the programs intended for the target computer. Then you just copy the installation result over the SSD/HDD of the destination computer. If you have many identical computers, you can copy the installed Gentoo over all of them without any problems, removing the need for multiple installations. If desired, you can keep the chroot environment with the installation result and perform any later updates on it. Then you synchronize the updated Gentoo from the chroot with the one or more target computers.
      - slicktux 2y ago
        Yes, there’s a few gentoo developers and bug hunters that do exactly that but to find bugs and test updates 8D!
  - whalesalad 2y ago
    Debian's debootstrap would also like to participate in this discussion
    - glitchcrab 2y ago
      Debootstrap is for installing a minimal system into a dir from another running system (so only useful in the setup phase), whereas arch-chroot is used to access an already installed system (e.g. when booting off a USB stick to fix something). They're not the same thing. The debootstrap-like tool in arch is called pacstrap.
- mystified5016 2y ago
  Manjaro has the same, I'd assume inherited from arch and modified. I just wish the script could figure out a BTRFS drive without me manually mounting volumes :(
  - out-of-ideas 2y ago
    i was very happy when that arch-chroot + pacstrap simplified my arch setup not having to run those mounts (i remember doin the same setup process for arch for centos/rhel just to not use anaconda and removing bloat, or rather installing what i wanted) for btrfs, if you use a consistent volume mapping on your systems, its pretty easy. in arch setup i typically enable ssh and have a pretty simple set of bashisms for target device, compression, and mount points. then its copy-pasta since its a boiler plate for when i need to recover or fresh install not glanced at manjaro so not familiar with its install-methods
- _lvbh 2y ago
  I've actually used this to unbrick my laptop before. Very useful
seba_dos1 2y ago
With qemu-user and binfmt you can even chroot into foreign CPU architectures, which is a handy thing to have when you mount your phone's eMMC to fix a hacking session gone wrong. Though these days you may want to look into things like systemd-nspawn instead of plain chroot.
- declan_roberts 2y ago
  Indeed you can skip most of the unnecessary additional mount requirements with systemd-nspawn. If /dev/sde1 (your root partition) is mounted to /tmp/rescue just run: systemd-nspawn --directory /tmp/rescue --boot -- --unit rescue.target It should automatically find the boot partition and mount it as well.
- thatcherc 2y ago
  > you can even chroot into foreign CPU architectures, which is a handy thing to have when you mount your phone's eMMC This sounds very interesting! What's the scenario where you'd do this? Would you be, for example, emulating an ARM processor with qemu on an x86 computer and chrooting into Android on an eMMC?
  - fragmede 2y ago
    yeah exactly that. your laptop is x86 and your phone or raspberry pi or other hardware is not.
  - messe 2y ago
    I've done this on some tinker boards we use at work. systemd-nspawn is a great tool for this.
  - bitbang 2y ago
    I've done this to build custom RPi images. Way faster than trying to build on a low power ARM platform, and way less fragile than cross compilers.
    - jlundberg 2y ago
dicroce 2y ago
I actually wish that instead of docker & etc we had just gotten a better chroot... Or maybe just a new kernel syscall that is chroot()++.
- gnuser 2y ago
  Pids and cgroups all the way down (also why the wise greybeards rejected docker)
- zoobab 2y ago
  Working on proot-docker, a bash script on top of skopeo and proot: https://github.com/mtseet/proot-docker https://github.com/mtseet/proot-docker We need more people to improve it!
- nesarkvechnep 2y ago
  Come to FreeBSD, we have just that - jails.
  - VWWHFSfQ 2y ago
    Or DragonFlyBSD with vkernels https://www.dragonflybsd.org/docs/handbook/vkernel/ https://www.dragonflybsd.org/docs/handbook/vkernel/
  - masom 2y ago
    yup! FreeBSD jails are essentially what OP wants with chroot++. I was pretty puzzled when Docker and LXC came around as this whole new thing believed to have "never been done before"; FreeBSD had supported a very similar concept for years before security groups were added in Linux. Jails and ezjail were stellar to make mini no-overhead containers when running various services on a server. Being able to archive them and expand them on a new machine was also pretty cool (as long as the BSD version was the same.)
    - microtonal 2y ago
      this whole new thing believed to have "never been done before"; Nobody with knowledge of sandboxing believed this, Virtuozzo and later OpenVZ had been on Linux for a long time after all. Virtuozzo was even from a similar time frame as FreeBSD jails (2000-ish). The key innovation of Docker was to provide a standardized way to build, distribute, and run container images.
stefantalpalaru 2y ago
[dead]
bigpeopleareold 2y ago
Ah - my attempt at doing this was almost there, except for the few bits that kept erroring out because I didn't mount the proc,dev,etc. mountpoints correctly :) Something to give another whirl on. At the time, I wanted something simple without docker to store everything development-related using different libraries. This is where debootstrap+chroot comes in - to build against various versions of libraries in Debian (if I remember correctly - it's been awhile.)
a_t48 2y ago
Currently working on scripts to provision a drive outside of the machine it’s meant to go on using chroot. I’ve so far accidentally unmounted /dev/pts several times from the host system and running docker inside the chroot caused a hard lock. Fun stuff.
miftassirri 2y ago
Haha, learned this technique while installing Void Linux
- mrbluecoat 2y ago
  Ha, that is funny. Void Linux desperately needs a better installer. (IMHO)
ddoolin 2y ago
Chroot has saved my system more times than I care to admit. I didn't really understand how it worked though, interesting.
andreareina 2y ago
This is how Linux From Scratch is done, and I've used the same technique to install missing video drivers that the Ubuntu install didn't include for whatever reason.
zokier 2y ago
Sure, chroot can be useful in a pinch, but it would not be the first thing I'd reach to. If you got the partitions mounted, you can already do quite a lot of things without needing to chroot.
- declan_roberts 2y ago
  This is usually right. In this particular case the issue was actually in /boot, which might not have been obvious just mounting the main partition.
artemonster 2y ago
I can highly recommend: https://github.com/fsquillace/junest https://github.com/fsquillace/junest
wang_li 2y ago
The tools shouldn't require the use of chroot. It is quite common on Solaris to be able to specify a path that should be considered the root directory for the tool, usually -R. This was super useful in a netboot world using nfs, and also for crash recovery. If a system is screwed up enough, then a chroot strategy won't work because it relies on the path you are chrooting to to be generally valid and functional. If it's missing libraries you may well be screwed.
remram 2y ago
Creating a mount namespace and using pivot_root seems like a safer solution.
- alexgartrell 2y ago
  I don’t think pivot_root is necessary for something like this, but a new mount namespace will definitely help avoid creating a mess on accident
  - deleted 2y ago
    [deleted]
- throwway120385 2y ago
  Came here to suggest this. pivot_root has the advantage that it can remount the existing root. It's essentially meant for going from an initramfs using linuxrc to boot to a full-on init in the other root filesystem. If things are horribly broken you could use a shell or some other process as init.
mycall 2y ago
Is there already a wrapper utility to automate all of this process laid out in the article?
- JanisErdmanis 2y ago
  sudo arch-chroot . This is now my default tool setting up raspberry like computers.
- amstan 2y ago
  There is! arch-chroot [1], despite its name pretty much does all the `mount -t proc` stuff the post says. It's also available on other distros like debian [2]. I have used it in the past to chroot into fedora as well. [1] https://man.archlinux.org/man/arch-chroot.8 https://man.archlinux.org/man/arch-chroot.8 [2] https://packages.debian.org/arch-install-scripts https://packages.debian.org/arch-install-scripts
- r4indeer 2y ago
  In addition to the other comments: If you are on NixOS, you can use nixos-enter [1]. [1] https://wiki.nixos.org/wiki/Change_root https://wiki.nixos.org/wiki/Change_root
amstan 2y ago
> sudo mkdir /rescue/boot > sudo mount /dev/nvme0n1p3 /rescue/boot This is a little extra. What you can generally do is immediatelly after chroot just run 'mount -a' to mount everything from the chroot's fstab. The empty `/boot` probably already exists.
- declan_roberts 2y ago
  Good idea!
yobbo 2y ago
chroot was (is?) the recommended way of installing gentoo which is pedagogical. There are various handy (chroot) techniques that are probably considered "old school" now. For example, having a "rescue partition" which can be booted into remotely, and from there reinstall or repair the "main os". This is necessary when repartitioning remotely, for example.
- jethro_tell 2y ago
  That’s still how most Linux OS installers install. They just do that for you. It’s still used for recovery but recovery partitions have kinda gone out of fashion as the ability to consistently boot has gotten better. Additionally, thumb drives and net boot make the partition a little less necessary.
whalesalad 2y ago
This is why Linux and Unix are so awesome. It’s really all just files.
- sgt 2y ago
  Not really, but yes there's a lot of files or things that seem to be files. Try plan9 though.
  - immibis 2y ago
    If you want to blow your mind in what's possible in operating-system isolation read about KeyKOS from 1985: https://css.csail.mit.edu/6.858/2014/readings/keykos.pdf https://css.csail.mit.edu/6.858/2014/readings/keykos.pdf Such systems are rarely very pragmatic, but do show off a bunch of weird concepts.
    - vacuity 2y ago
      Definitely weird, or perhaps I'm just not imaginative enough. I have a hard time figuring out what some KeyKOS constructs mean in familiar terms, particularly whether a given feature is an instance of essential or accidental complexity. I'm more familiar with today's seL4, which has carried on many of the principles of KeyKOS. Learning about the state of the art today is one thing, but learning history is quite another. I rely on simplicity in kernel design to avoid hindering more creative ideas that others have had.
- amelius 2y ago
  "files" is clearly a misnomer, it should have been "objects".
sgt 2y ago
Once I had to rescue a SunOS system and edit /etc/vfstab but I only had ed to my disposal. At that point I had never touched ed before, so that was a bit of a learning exercise, for sure.
- shagie 2y ago
  In a computer lab I hung out in back in college... We used rcp to keep passwords in sync. Add the account on the main machine, rcp the password file to the other machine. sudo rcp /etc/password other:/etc/passwd was muscle memory. One day, someone was getting added to the groups file to be able to work in the server web project. sudo rcp /etc/group other:/etc/passwd Ooops. Couldn't log in to fix it. "Is anyone logged into the other machine?" (someone said yes). "Type while 1 sync" ... (ok) ... And we flipped the power switch and brought it up in single user mode (since the password file was invalid). Next, need to establish a minimal /etc/passwd ... emacs /etc/passwd (nope) vi /etc/passwd (nope - invalid terminal 300h not in termcap). "Uhm... cat > /etc/passwd ?" (possible, but a PITA when there is a typo in transcription) I was a wizard on a lpmud. "I know ed". And we got a minimal password file restored while reading the hashed values over (no way where we going to have root::0:0:... as the file even for a second) and then rcp'ed the proper /etc/passwd and /etc/group file over to the other machine. https://www.gnu.org/fun/jokes/ed-msg.txt https://www.gnu.org/fun/jokes/ed-msg.txt
Arch-TK 2y ago
It's kind of funny to see this being called a technique. It has been something I've done so many times to impressive results. To me, it's just something you can do, among a million other things, if you know enough about Linux.
- akoboldfrying 2y ago
  "Technique" is a term for "something you can do, among a million other things, if you know enough about X".
jasongill 2y ago
This brings back memories - I owned a large web hosting company and we had thousands of machines. When hardware issues came up, or machines wouldn't boot, using this method was our first line of defense - we'd boot the machine from a burned copy of "Recovery Is Possible" which was an all-in-one Linux distro for recovery, then mount the partitions and chroot in to figure out what is going on - or use rsync to migrate data off as needed. Just looked and it looks like "Recovery Is Possible" hasn't been updated in a dozen years which dates my story, but I fondly remember overnight phone calls from panicked new sysadmins and telling them to be calm and "RIP it and get chrooted in" and then waking up to help them troubleshoot.
- woleium 2y ago
  System Rescue is what i use these days, but to be honest i can’t recall using it in the last couple of year. Virtualization and containers have taken over. https://www.system-rescue.org/ https://www.system-rescue.org/
  - jimmaswell 2y ago
    I use my Gentoo installation usb when this comes up
    - gerdesj 2y ago
      System Rescue used to be Gentoo based and then switched to Arch. You can install both Arch and Gentoo with SR and obviously you can install Arch with a Gentoo install CD and vice versa. SR also has some rather handy SAM database editing facilities. Mount Windows at /mnt and then enable and reset the Administrator password. Jolly handy for getting super duper user access on a Windows box. Its been a while since I installed Gentoo but you can probably quite easily add more stuff to your Gentoo install CD. I don't know if Gentoo have added a script to do all the bind mounts but "arch-chroot /bin/bash" is very convenient. I used to forget about /sys.
      - dev_hugepages 2y ago
jimmaswell 2y ago
I just installed Gentoo from WSL2 this way, on my secondary NVME on my Framework 16. Went without a hitch besides some minor things you need to be aware of: -the lack of access to efi subsystem from wsl means you need to pass some extra flags to help grub/etc along, and you may need to set it as the boot partition in the bios manually -you'll have to mount the drive to wsl with `wsl --mount <DiskPath> --bare`, after finding the right DiskPath with `Get-CimInstance -query "SELECT * from Win32_DiskDrive"`, and you might have to offline the disk first in Windows disk manager
- samuell 2y ago
  That's pretty incredible, that it works from Windows too! Now I'm just wondering if it would work from a Linux running in the browser, accessing the USB through WebUSB ;D
aussieguy1234 2y ago
What we all know as Docker and containers is really just fancy chroot. On non Linux systems, it's fancy chroot inside a Linux VM.
- immibis 2y ago
  Which raises the question of why they need chroot if they have the VM. Another semi-related but equally odd view: Docker is an operating system and containers are processes. The difference between Docker and chroot, by the way, is that Docker does a bunch more system calls to ch the root of several other things that are not the filesystem. It also sets up things inside those roots for you by default, so your containers can access the internet, for example.
  - aussieguy1234 2y ago
    I found this project to be an interesting POC of how it all actually works. https://github.com/p8952/bocker https://github.com/p8952/bocker Basically, it runs docker containers using chroot to prove that it's possible. Docker uses Layered Filesystems (Multiple Filesystems mounted under the same folder on top of one another), something that used to be mostly used when you have a read only Filesystem, like a cdrom, then mount a writeable folder over the same mount point to make that folder writeable. Bocker does a similar mounting of the layers with chroot to run docker containers.
ndsipa_pomu 2y ago
Used this or at least a very similar technique a few times to fix boot issues. I've got a version of the mounting command that I think is easier to use: for f in proc sys dev run dev/pts ; do mount --bind /$f /mnt/$f ; done Change the "/mnt/$f" to whatever mountpoint that you're using which would be "/rescue/$f" to align with TFA. I don't know what difference it makes to have /run mounted, but once you chroot into the mountpoint you can mount the boot partition etc and run whatever grub or mkinitramfs command you need to fix stuff. I would leave the /boot mounting to later in the process - after you chroot. This way you can easily check /etc/fstab for where the boot partition lives (or if there is one), so you only need to locate the root partition initially which is generally easy to figure out from the disk sizes. There's extra steps needed however if the system uses LVM.
vermaden 2y ago
[flagged]
- glitchcrab 2y ago
  What does the use of 'retarded' actually bring to your comment? That's entirely unnecessary.
budmichstelk 2y ago
Saved me many times from reaching for the CD to rescue my main. When you install Arch it uses this technique, very lightweight.
amelius 2y ago
What if I'm ssh'd into a Linux box and want to (say) format its root disk. Can I boot a new instance of Linux in memory and then access the root disk?
- ndsipa_pomu 2y ago
  Interesting question and I don't know how you'd do that - maybe using some statically linked binaries for fdisk and mkfs. However, why would you ever want to do that? If you want to remove data from the disk, then just running a suitable "dd" command would wipe the disk. I can't think of any other use case that wouldn't subsequently involve booting from a live iso which would let you format the disk anyway.
  - amelius 2y ago
    One use case is: what if the computer is at a remote location and you'd want to put a new image on the main disk. If Linux is currently using that disk as its root disk, then I suppose you'd have to somehow unmount it, or use a different instance of Linux that runs entirely in ram (so you can kill the original Linux instance and overwrite it).
    - ndsipa_pomu 2y ago
      I guess you could boot into a live installer ISO and get that to install over the root disk, though I don't know what problems you'd face with trying to unmount the original root partition. If you're wanting to do something like that fairly regularly, then it'd be easier to just run virtual machines (e.g. QEMU/KVM) to do that kind of thing.
- Cu3PO42 2y ago
  It's definitely possible. nixos-anywhere [0] implements this in a neat package for NixOS specifically. I am relatively certain you could use the same script to boot into a different distribution, though the installation part itself would obviously need to be adapted. [0] https://github.com/nix-community/nixos-anywhere https://github.com/nix-community/nixos-anywhere

301 points by mariuz 2y ago

The arch linux install has a little wrapper around chroot, used to configure the installed system without booting it. https://wiki.archlinux.org/title/Installation_guide#Chroot https://wiki.archlinux.org/title/Installation_guide#Chroot

znpy 2y ago
Gentoo’s stage3 would like to say a word
- slicktux 2y ago
  I remember first installing Gentoo…printed the whole manual and followed along. After a failed attempt and second successful install I learned enough to know that I could use a LiveUSB of my choosing and chroot into the install. Good times!
  - adrian_b 2y ago
    On Gentoo, it is also simple to install a completely new system in a chroot environment, even if it is intended for a computer with a different, but compatible architecture. This is frequently very convenient if you want to install Gentoo by compiling everything from sources on a cheap and small computer, e.g. one with some Intel Atom CPU. Instead of compiling anything on the resource-constrained computer, you install a fresh Gentoo system for it, in a chroot environment on a fast desktop computer, which supports a superset of the ISA of the small computer, so you can still execute the programs intended for the target computer. Then you just copy the installation result over the SSD/HDD of the destination computer. If you have many identical computers, you can copy the installed Gentoo over all of them without any problems, removing the need for multiple installations. If desired, you can keep the chroot environment with the installation result and perform any later updates on it. Then you synchronize the updated Gentoo from the chroot with the one or more target computers.
    - slicktux 2y ago
      Yes, there’s a few gentoo developers and bug hunters that do exactly that but to find bugs and test updates 8D!
- whalesalad 2y ago
  Debian's debootstrap would also like to participate in this discussion
  - glitchcrab 2y ago
    Debootstrap is for installing a minimal system into a dir from another running system (so only useful in the setup phase), whereas arch-chroot is used to access an already installed system (e.g. when booting off a USB stick to fix something). They're not the same thing. The debootstrap-like tool in arch is called pacstrap.
mystified5016 2y ago
Manjaro has the same, I'd assume inherited from arch and modified. I just wish the script could figure out a BTRFS drive without me manually mounting volumes :(
- out-of-ideas 2y ago
  i was very happy when that arch-chroot + pacstrap simplified my arch setup not having to run those mounts (i remember doin the same setup process for arch for centos/rhel just to not use anaconda and removing bloat, or rather installing what i wanted) for btrfs, if you use a consistent volume mapping on your systems, its pretty easy. in arch setup i typically enable ssh and have a pretty simple set of bashisms for target device, compression, and mount points. then its copy-pasta since its a boiler plate for when i need to recover or fresh install not glanced at manjaro so not familiar with its install-methods
_lvbh 2y ago
I've actually used this to unbrick my laptop before. Very useful

seba_dos1 2y ago

With qemu-user and binfmt you can even chroot into foreign CPU architectures, which is a handy thing to have when you mount your phone's eMMC to fix a hacking session gone wrong. Though these days you may want to look into things like systemd-nspawn instead of plain chroot.

declan_roberts 2y ago
Indeed you can skip most of the unnecessary additional mount requirements with systemd-nspawn. If /dev/sde1 (your root partition) is mounted to /tmp/rescue just run: systemd-nspawn --directory /tmp/rescue --boot -- --unit rescue.target It should automatically find the boot partition and mount it as well.
thatcherc 2y ago
> you can even chroot into foreign CPU architectures, which is a handy thing to have when you mount your phone's eMMC This sounds very interesting! What's the scenario where you'd do this? Would you be, for example, emulating an ARM processor with qemu on an x86 computer and chrooting into Android on an eMMC?
- fragmede 2y ago
  yeah exactly that. your laptop is x86 and your phone or raspberry pi or other hardware is not.
- messe 2y ago
  I've done this on some tinker boards we use at work. systemd-nspawn is a great tool for this.
- bitbang 2y ago
  I've done this to build custom RPi images. Way faster than trying to build on a low power ARM platform, and way less fragile than cross compilers.
  - jlundberg 2y ago

dicroce 2y ago

I actually wish that instead of docker & etc we had just gotten a better chroot... Or maybe just a new kernel syscall that is chroot()++.

gnuser 2y ago
Pids and cgroups all the way down (also why the wise greybeards rejected docker)
zoobab 2y ago
Working on proot-docker, a bash script on top of skopeo and proot: https://github.com/mtseet/proot-docker https://github.com/mtseet/proot-docker We need more people to improve it!
nesarkvechnep 2y ago
Come to FreeBSD, we have just that - jails.
- VWWHFSfQ 2y ago
  Or DragonFlyBSD with vkernels https://www.dragonflybsd.org/docs/handbook/vkernel/ https://www.dragonflybsd.org/docs/handbook/vkernel/
- masom 2y ago
  yup! FreeBSD jails are essentially what OP wants with chroot++. I was pretty puzzled when Docker and LXC came around as this whole new thing believed to have "never been done before"; FreeBSD had supported a very similar concept for years before security groups were added in Linux. Jails and ezjail were stellar to make mini no-overhead containers when running various services on a server. Being able to archive them and expand them on a new machine was also pretty cool (as long as the BSD version was the same.)
  - microtonal 2y ago
    this whole new thing believed to have "never been done before"; Nobody with knowledge of sandboxing believed this, Virtuozzo and later OpenVZ had been on Linux for a long time after all. Virtuozzo was even from a similar time frame as FreeBSD jails (2000-ish). The key innovation of Docker was to provide a standardized way to build, distribute, and run container images.

stefantalpalaru 2y ago

[dead]

bigpeopleareold 2y ago

Ah - my attempt at doing this was almost there, except for the few bits that kept erroring out because I didn't mount the proc,dev,etc. mountpoints correctly :) Something to give another whirl on. At the time, I wanted something simple without docker to store everything development-related using different libraries. This is where debootstrap+chroot comes in - to build against various versions of libraries in Debian (if I remember correctly - it's been awhile.)

a_t48 2y ago

Currently working on scripts to provision a drive outside of the machine it’s meant to go on using chroot. I’ve so far accidentally unmounted /dev/pts several times from the host system and running docker inside the chroot caused a hard lock. Fun stuff.

miftassirri 2y ago

Haha, learned this technique while installing Void Linux

mrbluecoat 2y ago
Ha, that is funny. Void Linux desperately needs a better installer. (IMHO)

ddoolin 2y ago

Chroot has saved my system more times than I care to admit. I didn't really understand how it worked though, interesting.

andreareina 2y ago

This is how Linux From Scratch is done, and I've used the same technique to install missing video drivers that the Ubuntu install didn't include for whatever reason.

zokier 2y ago

Sure, chroot can be useful in a pinch, but it would not be the first thing I'd reach to. If you got the partitions mounted, you can already do quite a lot of things without needing to chroot.

declan_roberts 2y ago
This is usually right. In this particular case the issue was actually in /boot, which might not have been obvious just mounting the main partition.

artemonster 2y ago

I can highly recommend: https://github.com/fsquillace/junest https://github.com/fsquillace/junest

wang_li 2y ago

The tools shouldn't require the use of chroot. It is quite common on Solaris to be able to specify a path that should be considered the root directory for the tool, usually -R. This was super useful in a netboot world using nfs, and also for crash recovery. If a system is screwed up enough, then a chroot strategy won't work because it relies on the path you are chrooting to to be generally valid and functional. If it's missing libraries you may well be screwed.

remram 2y ago

Creating a mount namespace and using pivot_root seems like a safer solution.

alexgartrell 2y ago
I don’t think pivot_root is necessary for something like this, but a new mount namespace will definitely help avoid creating a mess on accident
- deleted 2y ago
  [deleted]
throwway120385 2y ago
Came here to suggest this. pivot_root has the advantage that it can remount the existing root. It's essentially meant for going from an initramfs using linuxrc to boot to a full-on init in the other root filesystem. If things are horribly broken you could use a shell or some other process as init.

mycall 2y ago

Is there already a wrapper utility to automate all of this process laid out in the article?

JanisErdmanis 2y ago
sudo arch-chroot . This is now my default tool setting up raspberry like computers.
amstan 2y ago
There is! arch-chroot [1], despite its name pretty much does all the `mount -t proc` stuff the post says. It's also available on other distros like debian [2]. I have used it in the past to chroot into fedora as well. [1] https://man.archlinux.org/man/arch-chroot.8 https://man.archlinux.org/man/arch-chroot.8 [2] https://packages.debian.org/arch-install-scripts https://packages.debian.org/arch-install-scripts
r4indeer 2y ago
In addition to the other comments: If you are on NixOS, you can use nixos-enter [1]. [1] https://wiki.nixos.org/wiki/Change_root https://wiki.nixos.org/wiki/Change_root

amstan 2y ago

> sudo mkdir /rescue/boot > sudo mount /dev/nvme0n1p3 /rescue/boot This is a little extra. What you can generally do is immediatelly after chroot just run 'mount -a' to mount everything from the chroot's fstab. The empty `/boot` probably already exists.

declan_roberts 2y ago
Good idea!

yobbo 2y ago

chroot was (is?) the recommended way of installing gentoo which is pedagogical. There are various handy (chroot) techniques that are probably considered "old school" now. For example, having a "rescue partition" which can be booted into remotely, and from there reinstall or repair the "main os". This is necessary when repartitioning remotely, for example.

jethro_tell 2y ago
That’s still how most Linux OS installers install. They just do that for you. It’s still used for recovery but recovery partitions have kinda gone out of fashion as the ability to consistently boot has gotten better. Additionally, thumb drives and net boot make the partition a little less necessary.

whalesalad 2y ago

This is why Linux and Unix are so awesome. It’s really all just files.

sgt 2y ago
Not really, but yes there's a lot of files or things that seem to be files. Try plan9 though.
- immibis 2y ago
  If you want to blow your mind in what's possible in operating-system isolation read about KeyKOS from 1985: https://css.csail.mit.edu/6.858/2014/readings/keykos.pdf https://css.csail.mit.edu/6.858/2014/readings/keykos.pdf Such systems are rarely very pragmatic, but do show off a bunch of weird concepts.
  - vacuity 2y ago
    Definitely weird, or perhaps I'm just not imaginative enough. I have a hard time figuring out what some KeyKOS constructs mean in familiar terms, particularly whether a given feature is an instance of essential or accidental complexity. I'm more familiar with today's seL4, which has carried on many of the principles of KeyKOS. Learning about the state of the art today is one thing, but learning history is quite another. I rely on simplicity in kernel design to avoid hindering more creative ideas that others have had.
amelius 2y ago
"files" is clearly a misnomer, it should have been "objects".

sgt 2y ago

Once I had to rescue a SunOS system and edit /etc/vfstab but I only had ed to my disposal. At that point I had never touched ed before, so that was a bit of a learning exercise, for sure.

shagie 2y ago
In a computer lab I hung out in back in college... We used rcp to keep passwords in sync. Add the account on the main machine, rcp the password file to the other machine. sudo rcp /etc/password other:/etc/passwd was muscle memory. One day, someone was getting added to the groups file to be able to work in the server web project. sudo rcp /etc/group other:/etc/passwd Ooops. Couldn't log in to fix it. "Is anyone logged into the other machine?" (someone said yes). "Type while 1 sync" ... (ok) ... And we flipped the power switch and brought it up in single user mode (since the password file was invalid). Next, need to establish a minimal /etc/passwd ... emacs /etc/passwd (nope) vi /etc/passwd (nope - invalid terminal 300h not in termcap). "Uhm... cat > /etc/passwd ?" (possible, but a PITA when there is a typo in transcription) I was a wizard on a lpmud. "I know ed". And we got a minimal password file restored while reading the hashed values over (no way where we going to have root::0:0:... as the file even for a second) and then rcp'ed the proper /etc/passwd and /etc/group file over to the other machine. https://www.gnu.org/fun/jokes/ed-msg.txt https://www.gnu.org/fun/jokes/ed-msg.txt

Arch-TK 2y ago

It's kind of funny to see this being called a technique. It has been something I've done so many times to impressive results. To me, it's just something you can do, among a million other things, if you know enough about Linux.

akoboldfrying 2y ago
"Technique" is a term for "something you can do, among a million other things, if you know enough about X".

jasongill 2y ago

This brings back memories - I owned a large web hosting company and we had thousands of machines. When hardware issues came up, or machines wouldn't boot, using this method was our first line of defense - we'd boot the machine from a burned copy of "Recovery Is Possible" which was an all-in-one Linux distro for recovery, then mount the partitions and chroot in to figure out what is going on - or use rsync to migrate data off as needed. Just looked and it looks like "Recovery Is Possible" hasn't been updated in a dozen years which dates my story, but I fondly remember overnight phone calls from panicked new sysadmins and telling them to be calm and "RIP it and get chrooted in" and then waking up to help them troubleshoot.

woleium 2y ago
System Rescue is what i use these days, but to be honest i can’t recall using it in the last couple of year. Virtualization and containers have taken over. https://www.system-rescue.org/ https://www.system-rescue.org/
- jimmaswell 2y ago
  I use my Gentoo installation usb when this comes up
  - gerdesj 2y ago
    System Rescue used to be Gentoo based and then switched to Arch. You can install both Arch and Gentoo with SR and obviously you can install Arch with a Gentoo install CD and vice versa. SR also has some rather handy SAM database editing facilities. Mount Windows at /mnt and then enable and reset the Administrator password. Jolly handy for getting super duper user access on a Windows box. Its been a while since I installed Gentoo but you can probably quite easily add more stuff to your Gentoo install CD. I don't know if Gentoo have added a script to do all the bind mounts but "arch-chroot /bin/bash" is very convenient. I used to forget about /sys.
    - dev_hugepages 2y ago

jimmaswell 2y ago

I just installed Gentoo from WSL2 this way, on my secondary NVME on my Framework 16. Went without a hitch besides some minor things you need to be aware of: -the lack of access to efi subsystem from wsl means you need to pass some extra flags to help grub/etc along, and you may need to set it as the boot partition in the bios manually -you'll have to mount the drive to wsl with `wsl --mount <DiskPath> --bare`, after finding the right DiskPath with `Get-CimInstance -query "SELECT * from Win32_DiskDrive"`, and you might have to offline the disk first in Windows disk manager

samuell 2y ago
That's pretty incredible, that it works from Windows too! Now I'm just wondering if it would work from a Linux running in the browser, accessing the USB through WebUSB ;D

aussieguy1234 2y ago

What we all know as Docker and containers is really just fancy chroot. On non Linux systems, it's fancy chroot inside a Linux VM.

immibis 2y ago
Which raises the question of why they need chroot if they have the VM. Another semi-related but equally odd view: Docker is an operating system and containers are processes. The difference between Docker and chroot, by the way, is that Docker does a bunch more system calls to ch the root of several other things that are not the filesystem. It also sets up things inside those roots for you by default, so your containers can access the internet, for example.
- aussieguy1234 2y ago
  I found this project to be an interesting POC of how it all actually works. https://github.com/p8952/bocker https://github.com/p8952/bocker Basically, it runs docker containers using chroot to prove that it's possible. Docker uses Layered Filesystems (Multiple Filesystems mounted under the same folder on top of one another), something that used to be mostly used when you have a read only Filesystem, like a cdrom, then mount a writeable folder over the same mount point to make that folder writeable. Bocker does a similar mounting of the layers with chroot to run docker containers.

ndsipa_pomu 2y ago

Used this or at least a very similar technique a few times to fix boot issues. I've got a version of the mounting command that I think is easier to use: for f in proc sys dev run dev/pts ; do mount --bind /$f /mnt/$f ; done Change the "/mnt/$f" to whatever mountpoint that you're using which would be "/rescue/$f" to align with TFA. I don't know what difference it makes to have /run mounted, but once you chroot into the mountpoint you can mount the boot partition etc and run whatever grub or mkinitramfs command you need to fix stuff. I would leave the /boot mounting to later in the process - after you chroot. This way you can easily check /etc/fstab for where the boot partition lives (or if there is one), so you only need to locate the root partition initially which is generally easy to figure out from the disk sizes. There's extra steps needed however if the system uses LVM.

vermaden 2y ago

[flagged]

glitchcrab 2y ago
What does the use of 'retarded' actually bring to your comment? That's entirely unnecessary.

budmichstelk 2y ago

Saved me many times from reaching for the CD to rescue my main. When you install Arch it uses this technique, very lightweight.

amelius 2y ago

What if I'm ssh'd into a Linux box and want to (say) format its root disk. Can I boot a new instance of Linux in memory and then access the root disk?

ndsipa_pomu 2y ago
Interesting question and I don't know how you'd do that - maybe using some statically linked binaries for fdisk and mkfs. However, why would you ever want to do that? If you want to remove data from the disk, then just running a suitable "dd" command would wipe the disk. I can't think of any other use case that wouldn't subsequently involve booting from a live iso which would let you format the disk anyway.
- amelius 2y ago
  One use case is: what if the computer is at a remote location and you'd want to put a new image on the main disk. If Linux is currently using that disk as its root disk, then I suppose you'd have to somehow unmount it, or use a different instance of Linux that runs entirely in ram (so you can kill the original Linux instance and overwrite it).
  - ndsipa_pomu 2y ago
    I guess you could boot into a live installer ISO and get that to install over the root disk, though I don't know what problems you'd face with trying to unmount the original root partition. If you're wanting to do something like that fairly regularly, then it'd be easier to just run virtual machines (e.g. QEMU/KVM) to do that kind of thing.
Cu3PO42 2y ago
It's definitely possible. nixos-anywhere [0] implements this in a neat package for NixOS specifically. I am relatively certain you could use the same script to boot into a different distribution, though the installation part itself would obviously need to be adapted. [0] https://github.com/nix-community/nixos-anywhere https://github.com/nix-community/nixos-anywhere