Mount the filesystems we need so this can run as PID 1

init.go

@@ -0,0 +1,71 @@
+package main
+
+import (
+	"fmt"
+
+	"golang.org/x/sys/unix"
+)
+
+// Running as PID 1 there is nothing underneath us: sysfs and devtmpfs are what
+// every check, counter and device node below is reached through, and no one
+// else is going to mount them. Written as checks like everything else, so this
+// is a silent no-op under a running system.
+
+type mountSpec struct {
+	dir    string
+	fstype string
+	magic  int64
+	flags  uintptr
+}
+
+var wantMounts = []mountSpec{
+	{"/proc", "proc", unix.PROC_SUPER_MAGIC, unix.MS_NOSUID | unix.MS_NODEV | unix.MS_NOEXEC},
+	{"/sys", "sysfs", unix.SYSFS_MAGIC, unix.MS_NOSUID | unix.MS_NODEV | unix.MS_NOEXEC},
+	// devtmpfs reports itself as tmpfs, so an existing tmpfs on /dev is taken
+	// as good enough; the kernel populates the nodes either way.
+	{"/dev", "devtmpfs", unix.TMPFS_MAGIC, unix.MS_NOSUID},
+}
+
+func checkMount(m mountSpec) checkResult {
+	res := checkResult{item: "mount " + m.dir}
+	var st unix.Statfs_t
+	err := unix.Statfs(m.dir, &st)
+	if err == unix.ENOENT {
+		if err := unix.Mkdir(m.dir, 0o755); err != nil {
+			res.err = fmt.Errorf("creating %s: %w", m.dir, err)
+			res.fatal = true
+			return res
+		}
+		err = unix.Statfs(m.dir, &st)
+	}
+	if err != nil {
+		res.err = err
+		res.fatal = true
+		return res
+	}
+	if int64(st.Type) == m.magic {
+		res.state = m.fstype + " already mounted"
+		return res
+	}
+	if err := unix.Mount(m.fstype, m.dir, m.fstype, m.flags, ""); err != nil {
+		res.err = err
+		res.fatal = true
+		return res
+	}
+	res.fixed = true
+	res.state = "mounted " + m.fstype
+	return res
+}
+
+// Each mount is what the next check stands on, so the first failure ends it.
+func mountFilesystems() []checkResult {
+	var out []checkResult
+	for _, m := range wantMounts {
+		res := checkMount(m)
+		out = append(out, res)
+		if res.fatal {
+			return out
+		}
+	}
+	return out
+}