Difference between revisions of "Change root"

From ArchWiki
Jump to: navigation, search
(Exit from the chroot environment: unmounting covered elsewhere; exit command now covered above; rm)
(Using systemd-nspawn: add link to systemd-nspawn, rm info that only applies when "-b" flag is used)
Line 102: Line 102:
 
=== Using systemd-nspawn ===
 
=== Using systemd-nspawn ===
  
systemd-nspawn may be used to run a command or OS in a light-weight namespace container. In many ways it is similar to chroot, but more powerful since it fully virtualizes the file system hierarchy, as well as the process tree, the various IPC subsystems and the host and domain name.
+
[[systemd-nspawn]] may be used to run a command or OS in a light-weight namespace container. In many ways it is similar to chroot, but more powerful since it fully virtualizes the file system hierarchy, as well as the process tree, the various IPC subsystems and the host and domain name.
  
 
Change directory to the mountpoint of the root partition and run systemd-nspawn:
 
Change directory to the mountpoint of the root partition and run systemd-nspawn:
Line 109: Line 109:
 
  # systemd-nspawn
 
  # systemd-nspawn
  
It is not necessary to mount api filesystems like {{ic|/proc}} manually, as systemd-nspawn starts a new init process in the contained environment which takes care of everything. It is like booting up a second Linux OS on the same machine, but it is not a virtual machine.
+
It is not necessary to mount api filesystems like {{ic|/proc}} manually, since systemd-nspawn starts a new init process in the contained environment which takes care of everything.
  
To quit, just log out or issue the poweroff command. You can then unmount the partitions as described in [[#Exit from the chroot environment]].
+
See [[systemd-nspawn]] for more detailed examples and other uses.
  
 
== Run graphical applications from chroot ==
 
== Run graphical applications from chroot ==

Revision as of 20:28, 11 October 2016

zh-cn:Change root

Chroot is an operation that changes the apparent root directory for the current running process and their children. A program that is run in such a modified environment cannot access files and commands outside that environmental directory tree. This modified environment is called a chroot jail.

Reasoning

Changing root is commonly done for performing system maintenance on systems where booting and/or logging in is no longer possible. Common examples are:

See also Wikipedia:Chroot#Limitations.

Requirements

  • Root privilege.
  • Another Linux environment, e.g. a LiveCD or USB flash media, or from another existing Linux distribution.
  • Matching architecture environments; i.e. the chroot from and chroot to. The architecture of the current environment can be discovered with: uname -m (e.g. i686 or x86_64).
  • Kernel modules loaded that are needed in the chroot environment.
  • Swap enabled if needed:
    # swapon /dev/sdxY
  • Internet connection established if needed.

Usage

Note:
  • Some systemd tools such as localectl and timedatectl can not be used inside a chroot, as they require an active dbus connection. [1]
  • The file system that will serve as / of your chroot must accessible (i.e., decrypted, mounted).

There are several options for using chroot, described below. To exit any of these simply use the exit command.

Using arch-chroot

The bash script arch-chroot is part of the arch-install-scripts package. Before running /usr/bin/chroot the script mounts api filesystems like /proc and makes /etc/resolv.conf available from the chroot.

Run arch-chroot with the new root directory as first argument:

# arch-chroot /mnt/arch

To run a bash shell instead of the default sh:

# arch-chroot /mnt/arch /bin/bash

To run mkinitcpio -p linux from the chroot, and exit again:

# arch-chroot /mnt/arch /usr/bin/mkinitcpio -p linux

Using chroot

Warning: When using --rbind, some subdirectories of dev/ and sys/ will not be unmountable. Attempting to unmount with umount -l in this situation will break your session, requiring a reboot. If possible, use -o bind instead.

Mount the temporary api filesystems:

# cd /mnt/arch
# mount -t proc proc proc/
# mount --rbind /sys sys/
# mount --rbind /dev dev/

And optionally:

# mount --rbind /run run/

To use an internet connection in the chroot environment copy over the DNS details:

# cp /etc/resolv.conf etc/resolv.conf

To change root into a bash shell:

# chroot /mnt/arch /bin/bash
Note: If you see the error:
  • chroot: cannot run command '/usr/bin/bash': Exec format error, it is likely that the architectures of the host environment and chroot environment do not match.
  • chroot: '/usr/bin/bash': permission denied, remount with the exec permission: mount -o remount,exec /mnt/arch.

After chrooting it may be necessary to load the local bash configuration:

# source /etc/profile
# source ~/.bashrc
Tip: Optionally, create a unique prompt to be able to differentiate your chroot environment:
# export PS1="(chroot) $PS1"

Using systemd-nspawn

systemd-nspawn may be used to run a command or OS in a light-weight namespace container. In many ways it is similar to chroot, but more powerful since it fully virtualizes the file system hierarchy, as well as the process tree, the various IPC subsystems and the host and domain name.

Change directory to the mountpoint of the root partition and run systemd-nspawn:

# cd /mnt/arch
# systemd-nspawn

It is not necessary to mount api filesystems like /proc manually, since systemd-nspawn starts a new init process in the contained environment which takes care of everything.

See systemd-nspawn for more detailed examples and other uses.

Run graphical applications from chroot

If you have an X server running on your system, you can start graphical applications from the chroot environment.

To allow the chroot environment to connect to an X server, open a virtual terminal inside the X server (i.e. inside the desktop of the user that is currently logged in), then run the xhost command, which gives permission to anyone to connect to the user's X server:

$ xhost +local:

Then, to direct the applications to the X server from chroot, set the DISPLAY environment variable inside the chroot to match the DISPLAY variable of the user that owns the X server. So for example, run

$ echo $DISPLAY

as the user that owns the X server to see the value of DISPLAY. If the value is ":0" (for example), then in the chroot environment run

# export DISPLAY=:0

Without root privileges

Chroot requires root privileges, which may not be desirable or possible for the user to obtain in certain situations. There are, however, various ways to simulate chroot-like behavior using alternative implementations.

Proot

Proot may be used to change the apparent root directory and use mount --bind without root privileges. This is useful for confining applications to a single directory or running programs built for a different CPU architecture, but it has limitations due to the fact that all files are owned by the user on the host system. Proot provides a --root-id argument that can be used as a workaround for some of these limitations in a similar (albeit more limited) manner to fakeroot.

Fakechroot

fakechroot is a library shim which intercepts the chroot call and fakes the results. It can be used in conjunction with fakeroot to simulate a chroot as a regular user.

# fakechroot fakeroot chroot ~/my-chroot bash

See also