linux-container: Remount / recursively as MS_PRIVATE, immediately after entering the new mount namespace.

Apply the same workaround that runc, crun, and buildah apply
unconditionally: immediately after entering the new mount namespace,
remount / recursively as MS_PRIVATE. Concretely, the call we will
make in Guile mirrors the verbatim C call already present in crun at
https://github.com/containers/crun/blob/99a8512ef50c5af1b8cfff28eacddf870220ca9f/src/libcrun/linux.c#L4677:

    ret = mount (NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL);

and the Go equivalents in:

- runc (defaults to MS_SLAVE for reasons documented in its pivotRoot):
https://github.com/opencontainers/runc/blob/a7e766484c38be1f0cf9b7d960c9324316cb7204/libcontainer/rootfs_linux.go#L1106

- buildah (expands to mount("", "/", "none", MS_REC|MS_PRIVATE, "")):
https://github.com/podman-container-tools/buildah/blob/769d311d739dd4bbde496a9480879ce6aadaa1e0/bind/mount.go#L41

Our implementation:

1. Detaches the container's mount namespace from the host's propagation
peer group, so subsequent mount/umount events inside the container
do not propagate to the host.
2. Makes the kernel's pivot_root(2) preconditions satisfied: both
new_root (the tmpfs we then create) and its parent (/) have propagation
type MS_PRIVATE.
3. Should have no effect on processes outside the new mount namespace. The
host's / retains whatever propagation type it had.

mount-file-systems is only invoked from run-container when both
'mnt namespace is requested and root != "/", so we are
guaranteed to be inside a fresh mount namespace at this point and that
the remount only affects this namespace. The remount must happen before
the tmpfs is created. Once the tmpfs exists as a child of the (shared)
host /, fixing only the host / does not retroactively change the
propagation type the tmpfs already inherited. Doing the remount first
means every subsequent mount this function performs inherits MS_PRIVATE
from its parent.

* guix/build/syscalls.scm (MS_PRIVATE): New variable.
* gnu/build/linux-container.scm (mount-file-systems): Remount / recursively as MS_PRIVATE, immediately after entering the new mount namespace.
* gnu/services/containers.scm (%miniflux-create-admin-credentials,
%rootless-podman-os-with-least-authority-wrapper,
run-rootless-podman-test-with-least-authority-wrapper): New bindings.
(%test-rootless-podman-with-least-authority-wrapper): New regression
test making sure the rootless-podman-service-type does not break again
least-authority-wrapper bases services.

Fixes: https://codeberg.org/guix/guix/issues/3233
Merges: https://codeberg.org/guix/guix/pulls/9140

3 files changed, 109 insertions, 1 deletions

diff --git a/gnu/build/linux-container.scm b/gnu/build/linux-container.scm
index bc1f8851dd2..32990f4dac5 100644
--- a/gnu/build/linux-container.scm
+++ b/gnu/build/linux-container.scm
@@ -1,6 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2015 David Thompson <davet@gnu.org>
 ;;; Copyright © 2017-2019, 2022-2023, 2025 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2026 Giacomo Leidi <therewasa@fishinthecalculator.me>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -104,6 +105,16 @@ for the process."
     (mkdir-p target)
     (mount source target type flags options #:update-mtab? update-mtab?))
 
+  ;; Detach our mount namespace from the host's propagation peer
+  ;; group.  Without this, when the host's / is MS_SHARED - as it
+  ;; is on a system running rootless-podman-service-type, and as it
+  ;; is by default on systemd hosts - 'pivot_root' below fails
+  ;; with EINVAL because the new root and its parent must not have
+  ;; propagation type MS_SHARED (pivot_root(2)).  This is the same
+  ;; remount that runc, crun and buildah perform immediately after
+  ;; unshare(CLONE_NEWNS).
+  (mount #f "/" #f (logior MS_REC MS_PRIVATE))
+
   ;; The container's file system is completely ephemeral, sans directories
   ;; bind-mounted from the host.
   (mount "none" root "tmpfs")
diff --git a/gnu/tests/containers.scm b/gnu/tests/containers.scm
index 6fb7d6d5463..6b7dd7f355f 100644
--- a/gnu/tests/containers.scm
+++ b/gnu/tests/containers.scm
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2024, 2025 Giacomo Leidi <therewasa@fishinthecalculator.me>
+;;; Copyright © 2024-2026 Giacomo Leidi <therewasa@fishinthecalculator.me>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -22,16 +22,19 @@
   #:use-module (guix build-system trivial)
   #:use-module (gnu packages bash)
   #:use-module (gnu packages containers)
+  #:use-module (gnu packages databases)
   #:use-module (gnu packages guile)
   #:use-module (gnu packages guile-xyz)
   #:use-module (gnu services)
   #:use-module (gnu services containers)
+  #:use-module (gnu services databases)
   #:use-module (gnu services desktop)
   #:use-module ((gnu services docker)
                 #:select (containerd-service-type
                           docker-service-type))
   #:use-module (gnu services dbus)
   #:use-module (gnu services networking)
+  #:use-module (gnu services web)
   #:use-module (gnu system)
   #:use-module (gnu system accounts)
   #:use-module (gnu system vm)
@@ -43,6 +46,7 @@
   #:use-module ((guix scripts pack) #:prefix pack:)
   #:use-module (guix store)
   #:export (%test-rootless-podman
+            %test-rootless-podman-with-least-authority-wrapper
             %test-oci-service-rootless-podman
             %test-oci-service-docker))
 
@@ -69,6 +73,42 @@
                           (supplementary-groups '("wheel" "netdev" "cgroup"
                                                   "audio" "video")))))))
 
+(define %miniflux-create-admin-credentials
+  #~(begin
+      (mkdir "/var/miniflux")
+      (call-with-output-file "/var/miniflux/admin-username"
+        (lambda (port)
+          (display "test" port)))
+      (call-with-output-file "/var/miniflux/admin-password"
+        (lambda (port)
+          (display "testpassword" port)))))
+
+;; A separate operating-system definition is necessary to test the interactions
+;; between rootless podman and least-authority-wrapper backed services, miniflux
+;; in this case. For the purpose of the test, any service using it should be
+;; fine though.
+(define %rootless-podman-os-with-least-authority-wrapper
+  (simple-operating-system
+   (service rootless-podman-service-type
+           (rootless-podman-configuration
+            (subgids
+             (list (subid-range (name "alice"))))
+            (subuids
+             (list (subid-range (name "alice"))))))
+   (service dhcpcd-service-type)
+   (service dbus-root-service-type)
+   (service polkit-service-type)
+   (service elogind-service-type)
+   (simple-service 'create-miniflux-admin-credentials
+                    activation-service-type
+                    %miniflux-create-admin-credentials)
+   (service postgresql-service-type
+            (postgresql-configuration
+             (postgresql postgresql)))
+   (service miniflux-service-type
+            (miniflux-configuration
+             (listen-address "/var/run/miniflux/miniflux.sock")))))
+
 (define (run-rootless-podman-test oci-tarball)
 
   (define os
@@ -345,12 +385,67 @@ standard output device and then enters a new line.")
                  #:localstatedir? #t)))
     (run-rootless-podman-test tarball)))
 
+(define (run-rootless-podman-test-with-least-authority-wrapper)
+
+  (define os
+    (marionette-operating-system
+     %rootless-podman-os-with-least-authority-wrapper
+     #:imported-modules '((gnu services herd)
+                          (guix combinators))))
+
+  (define vm
+    (virtual-machine
+      (operating-system os)
+      (volatile? #t)
+      (memory-size 1024)
+      (disk-image-size (* 3000 (expt 2 20)))
+      (port-forwardings '())))
+
+  (define test
+    (with-imported-modules '((gnu build marionette)
+                             (gnu services herd))
+      #~(begin
+          (use-modules (srfi srfi-11) (srfi srfi-64)
+                       (gnu build marionette))
+
+          (define marionette
+            ;; Relax timeout to accommodate older systems and
+            ;; allow for pulling the image.
+            (make-marionette (list #$vm) #:timeout 60))
+
+          (test-runner-current (system-test-runner #$output))
+
+          (test-begin "rootless-podman-with-least-authority-wrapper")
+
+          (test-assert "services start correctly"
+            (marionette-eval
+             '(begin
+                (use-modules (gnu services herd))
+                (wait-for-service 'file-system-/sys/fs/cgroup)
+                (wait-for-service 'miniflux))
+             marionette))
+
+          (test-assert "Check miniflux socket file is created"
+            (wait-for-unix-socket "/var/run/miniflux/miniflux.sock" marionette))
+
+          (test-end))))
+  (gexp->derivation "rootless-podman-with-least-authority-wrapper-test" test))
+
 (define %test-rootless-podman
   (system-test
    (name "rootless-podman")
    (description "Test rootless Podman service.")
    (value (build-tarball&run-rootless-podman-test))))
 
+(define %test-rootless-podman-with-least-authority-wrapper
+  (system-test
+   (name "rootless-podman-with-least-authority-wrapper")
+   (description "Test rootless Podman service, making sure services based on
+least-authority-wrapper keep working. See
+https://codeberg.org/guix/guix/issues/3233 for an example of how it has broken
+in the past.")
+   (value (run-rootless-podman-test-with-least-authority-wrapper))))
+
 (define %guile-oci-image
   (oci-image
     (repository "guile")
diff --git a/guix/build/syscalls.scm b/guix/build/syscalls.scm
index 7a5727a8d46..e92bca7aaa3 100644
--- a/guix/build/syscalls.scm
+++ b/guix/build/syscalls.scm
@@ -55,6 +55,7 @@
             MS_BIND
             MS_MOVE
             MS_REC
+            MS_PRIVATE
             MS_SHARED
             MS_LAZYTIME
             MNT_FORCE
@@ -564,6 +565,7 @@ the last argument of `mknod'."
 (define MS_BIND            4096)
 (define MS_MOVE            8192)
 (define MS_REC            16384)
+(define MS_PRIVATE       262144)
 (define MS_SHARED       1048576)
 (define MS_RELATIME     2097152)
 (define MS_STRICTATIME 16777216)