#!/bin/bash
# =============================================================================
# plugin/sbin/crun-no-pivot.sh
#
# Thin OCI-runtime wrapper around crun, injecting --no-pivot on `create`/
# `run`. Unraid's / is the kernel's initial "rootfs" pseudo-filesystem —
# Unraid never pivots to a real one during boot, the whole OS runs from
# RAM — and pivot_root(2) unconditionally rejects that as the "old root"
# (EINVAL). runc (what Docker uses) silently falls back to an MS_MOVE-based
# chroot in that situation; crun has no such fallback and no config-file
# equivalent, only this per-invocation flag — so config/containers.conf
# points podman's crun runtime at this wrapper instead of crun directly.
# See docs/ARCHITECTURE.md section 8.
#
# Verified live: without this, every container fails with
# "crun: pivot_root: Invalid argument: OCI runtime error".
#
# --no-pivot is only a valid flag on crun's create/run subcommands (see
# `crun run --help`) — every other subcommand (delete, exec, kill, list,
# ...) is passed straight through unmodified. podman invokes crun with its
# own global flags BEFORE the subcommand (e.g.
# `crun --log-format=json --log <path> create --bundle <path> ...`), so
# the subcommand is not reliably $1 — scan every argument instead of only
# checking the first one, and insert --no-pivot immediately after
# create/run wherever it actually appears.
# =============================================================================

args=()
found=0
for arg in "$@"; do
  args+=("$arg")
  if [ "$found" -eq 0 ] && { [ "$arg" = create ] || [ "$arg" = run ]; }; then
    args+=("--no-pivot")
    found=1
  fi
done
exec /usr/bin/crun "${args[@]}"