Dear Maintainer,

We use fakechroot for building a live OS that starts out with debootstrap. This worked fine for a while, but started to fail last week. Now apt crashes when it ties to download anything:
https://github.com/AminaBank/livedeb/blob/master/Dockerfile#L85
 => ERROR [stage-8  4/30] RUN fakechroot chroot ROOTFS apt-get update  && fakechroot chroot ROOTFS a  1.2s
------                                                                                                     
 > [stage-8  4/30] RUN fakechroot chroot ROOTFS apt-get update  && fakechroot chroot ROOTFS apt-get -y dist-upgrade  && fakechroot chroot ROOTFS apt-get install -y --no-install-recommends 	curl 	dosfstools electrum 	fdisk 	firefox-esr 	fonts-freefont-ttf 	fonts-noto-mono 	keepassxc 	libgl1 	libglib2.0-0 	libykpiv2 	minicom 	mousepad 	mtools 	openssh-client 	p7zip-full pcscd 	python3-pyqt5 	systemd-resolved 	systemd-timesyncd 	thunar-archive-plugin 	xarchiver xfce4 	xfce4-terminal 	xinit 	xserver-xorg 	yubikey-manager:
#9 0.613 Reading package lists...
#9 1.059 E: Method http has died unexpectedly!
#9 1.059 E: Sub-process http received a segmentation fault.
#9 1.059 E: Method /usr/lib/apt/methods/http did not start correctly
#9 1.059 E: Failed to fetch http://deb.debian.org/debian/dists/bookworm/InRelease
#9 1.059 E: Some index files failed to download. They have been ignored, or old ones used instead.

I don't know where the problem really lies, but when I buil an older version, where fakechroot was not used, then it builds just fine:
https://github.com/AminaBank/livedeb/blob/b38de278e45f0175f5d9c5fc39716a4e31eda6c3/Dockerfile#L37

The first version that uses fakechroot generates a slightly different error messages, but also at about the same place:
https://github.com/AminaBank/livedeb/blob/e22eda84c67643da13d46cb56a24e1eb47fdbfcd/Dockerfile#L57
Step 11/50 : RUN fakechroot chroot ROOTFS apt-get update
 ---> Running in 9f203eea9b98
*** stack smashing detected ***: terminated
Aborted (core dumped)
The command '/bin/sh -c fakechroot chroot ROOTFS apt-get update' returned a non-zero code: 134

I am reporting this from my trixie system, but the same happens on bookworm systems, and bookworm is used inside the relevant Docker container.

Hi,

Quoting Richard Ulrich (2024-04-30 10:44:46)

read the section LIMITATIONS of the fakechroot man page. You have to use the
exact system on the outside of the chroot as you are using inside of the
chroot. I have CI systems testing fakechroot daily on a fresh Debian unstable
setup and it works fine. So if it doesn't work for you, then it is very likely
due to the limitations of fakechroot itself. Thus, tagging this bug as
unreproducible.

Now... I had a look at your Dockerfile and at your project livedeb. I think you
can do a number of improvements which in the end will allow you to completely
get rid of fakechroot.

Firstly, you are are using docker for isolation. Why do you even bother with
fakechroot? Can you not just use normal chroot inside of docker?

Secondly, you can completely get rid of docker if you replace debootstrap and
fakechroot with mmdebstrap in unshare mode. Using mmdebstrap has several
advantages for your use-case:

 1. it does not require superuser privileges, so you do not need to run
    everything inside a docker container anymore

 2. its native output format is a tarball so you can just run:

    mmdebstrap [...] | mksquashfs - filesystem.squashfs

 3. even better, squashfs is one of the native output formats of mmdebstrap so
    if you don't need any special squashfs options you could even just call

    mmdebstrap [..] filesystem.squashfs

 4. you want the result to be bit-by-bit reproducible. The output of mmdebstrap
    is reproducible by default with the same SOURCE_DATE_EPOCH

The only reason I'm still maintaining fakechroot is because it's a fun hacking
project but given that unshared user namespaces provide far superior
functionality I heavily recommend against using fakechroot in production.

Write me if you need any help converting your dockerfile into mmdebstrap calls.

Thanks!

cheers, josch