How to run Plop Linux inside of Lxroot?

[parke]

I'm copying chatchoi's question to this new thread.

@chatchoi asked:

I'm trying to run Plop Linux with lxroot. It's a normal compressed rootfs:

https://download.plop.at/ploplinux/25.2/desktop/ploplinux-desktop-25.2-x86_64.tar.gz

I don't want to use sudo so I choose to extract the archive with my unprivileged user account. There are some errors:

tar: ploplinux-desktop-25.2-x86_64/var/named/chroot/dev/random: Cannot mknod: Operation not permitted
tar: ploplinux-desktop-25.2-x86_64/var/named/chroot/dev/zero: Cannot mknod: Operation not permitted
tar: ploplinux-desktop-25.2-x86_64/var/named/chroot/dev/null: Cannot mknod: Operation not permitted
tar: ploplinux-desktop-25.2-x86_64/var/named/chroot/dev/urandom: Cannot mknod: Operation not permitted
tar: Exiting with failure status due to previous errors

But lxroot into ploplinux-desktop-25.2-x86_64 is fine. After that, I realized that I can't write anything:

fatal: could not create work tree dir 'lxroot': Read-only file system

(I tried to clone the lxroot repository with git)

I found that /tmp is writable, but now I'm facing DNS issue:

fatal: unable to access 'https://github.com/parke/lxroot/': Could not resolve host: github.com

[parke]

(1) The Cannot mknod errors are expected when you extract (as non-root) a tar file that contains device nodes. Only root can create device nodes.

These errors are probably not a problem for Lxroot, because Lxroot (at least by default) expects newroot/dev to be an empty directory. Lxroot will simply bind mount /dev (from the host) to newroot/dev. This allows Lxroot to simply reuse the host's /dev directory inside the guest environment.

(2) Regarding not being able to write anything: By default, inside Lxroot, you can write to /tmp, /home, and a couple other locations.

If you want to be able to write anywhere, try running Lxroot with the -w option. For example, lxroot -w newroot

If you just want to write to your home directory, make sure that newroot/home/$USER directory exists before you run Lxroot. (Aside: Perhaps it would be a good idea for me to modify Lxroot to print a warning if the home directory does not exist?)

(3) Regarding network access: By default, Lxroot does not provide network access. If you want Lxroot to provide network access, then run Lxroot with the -n option. For example: lxroot -n newroot.

If newroot/etc/resolv.conf does not exist, Lxroot will offer to copy the host's resolv.conf into the guest. Even so, if you are encountering DNS errors, check to make sure resolv.conf is valid inside the guest. If newroot/etc/resolv.conf is a symlink, it may be a broken symlink inside the guest. In this case, you may need to manually fix the guest's resolv.conf.

(4) You may combine -n and -w. For example: lxroot -nw newroot.

If I have time later today, I may try to download the Plop Linux tarball you referenced to see if I can run PHP inside it.

Fyi, by default, Lxroot does not edit /etc/passwd or /etc/group. If programs expect to find certain information inside either /etc/passwd or /etc/group, you may need to manually edit those files to add whatever information the programs require.

Good luck!

Please let me know if the above information is helpful, or if you have any additional questions.

[ghost]

Even with -nw, the DNS issue is still there:

fatal: unable to access 'https://github.com/parke/lxroot/': Could not resolve host: github.com

I tried to ping a website but it failed:

ping: Lacking privilege for icmp socket.

So the only way to test network connection for me is doing a git clone.

[ghost]

/home is not writable without -w, do you mean /home/$USER? Unfortunately, Plop Linux doesn't have a normal user account out of the box for me. It only has root. I recall when I played with chroot (before discovered lxroot), I tried to create a normal user account with the same name and group as my user account on the host, but it turned out to have different uid and gid.

[parke]

Even with -nw, the DNS issue is still there:

fatal: unable to access 'https://github.com/parke/lxroot/': Could not resolve host: github.com

Please run ls -l /etc/resolv.conf inside Lxroot and send me the output.

I tried to ping a website but it failed:

ping: Lacking privilege for icmp socket.

ping probably will not run inside of Lxroot, as ping requires administrator-level access to the network interface. More info here:

https://labex.io/tutorials/linux-how-to-handle-ping-permission-issues-435753

Try running ip a inside Lxroot to see the network interfaces. You could also use netcat or nc to try to connect to TCP ports on local or remote machines. For example: netcat $ip_address 22 will try to connect to an SSH server.

For example, here is what I get:

$ netcat localhost 22
SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.8
^C

[parke]

/home is not writable without -w, do you mean /home/$USER? Unfortunately, Plop Linux doesn't have a normal user account out of the box for me. It only has root. I recall when I played with chroot (before discovered lxroot), I tried to create a normal user account with the same name and group as my user account on the host, but it turned out to have different uid and gid.

I was wrong about /home being writable. Sorry about that. (/home is writable in the unpublished development version of Lxroot that I'm currently working on, but that is not the version you are using.)

For reference, here is the line of code that will make $HOME writable:

lxroot/lxroot.cpp

Line 1429 in 223c160

expose_path ( st .env .get ( "HOME" ), o_ra );

The value of $HOME will be the first of:

1. The home directory specified in newroot/etc/passwd, if a matching UID is found.
2. The value of the environment variable HOME, if that variable is set.
3. The home directory specified in /etc/passwd (on the host machine), if a matching UID is found.

The directory must exist before you run Lxroot. Lxroot will not create the directory for you.

Please let me know if this helps you get a writable home directory. If it does not, I will download the Plop Linux rootfs file and try to provide you additional, more precise instructions.

Good luck!

[parke]

I downloaded ploplinux-desktop-25.2-x86_64.tar.gz onto a VPS.

I cloned the public git repository of Lxroot and built it (resulting in version 0.22.1 of Lxroot.)

On this VPS, my username is hack.

Therefore, I did the following:

$ tar xzf ploplinux-desktop-25.2-x86_64.tar.gz
tar: ploplinux-desktop-25.2-x86_64/var/named/chroot/dev/random: Cannot mknod: Operation not permitted
tar: ploplinux-desktop-25.2-x86_64/var/named/chroot/dev/zero: Cannot mknod: Operation not permitted
tar: ploplinux-desktop-25.2-x86_64/var/named/chroot/dev/null: Cannot mknod: Operation not permitted
tar: ploplinux-desktop-25.2-x86_64/var/named/chroot/dev/urandom: Cannot mknod: Operation not permitted
tar: Exiting with failure status due to previous errors
$ mkdir ploplinux-desktop-25.2-x86_64/home/hack
$ lxroot --version
lxroot  version  0.22.1
$ lxroot -n ploplinux-desktop-25.2-x86_64
$ pwd
/home/hack
$ ls -la /home/hack
total 4
drwxr-xr-x 1 1005 1005 26 May 20 20:52 .
drwxr-xr-x 1 1005 1005 18 May 20 20:46 ..
-rw------- 1 1005 1005 60 May 20 20:48 .bash_history
$ touch foo
$ ls -la /home/hack
total 4
drwxr-xr-x 1 1005 1005 32 May 20 20:55 .
drwxr-xr-x 1 1005 1005 18 May 20 20:46 ..
-rw------- 1 1005 1005 60 May 20 20:48 .bash_history
-rw-r--r-- 1 1005 1005  0 May 20 20:55 foo
$ netcat localhost 22
SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.10
^C

Everything works as I expect it to.

Note that ls -la displays the UID as 1005. This is because I have not manually edited ploplinux-desktop-25.2-x86_64/etc/passwd to add the user hack with a UID of 1005.

Please let me know if you can reproduce the above and/or if you have any other questions.

Good luck!

[parke]

Testing DNS:

$ lxroot -nw ploplinux-desktop-25.2-x86_64
$ cat /etc/resolv.conf
nameserver 127.0.0.1
$ dig www.google.com
;; communications error to 127.0.0.1#53: connection refused
;; communications error to 127.0.0.1#53: connection refused
;; communications error to 127.0.0.1#53: connection refused

; <<>> DiG 9.21.3 <<>> www.google.com
;; global options: +cmd
;; no servers could be reached
$ echo 'nameserver 8.8.8.8' > /etc/resolv.conf
$ dig www.google.com

; <<>> DiG 9.21.3 <<>> www.google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 38209
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;www.google.com.                        IN      A

;; ANSWER SECTION:
www.google.com.         173     IN      A       142.251.35.164

;; Query time: 23 msec
;; SERVER: 8.8.8.8#53(8.8.8.8) (UDP)
;; WHEN: Tue May 20 21:09:25 PDT 2025
;; MSG SIZE  rcvd: 59

Summary:

• By default, Plop Linux expects a nameserver at 127.0.0.1.
• Because I am not running a nameserver on 127.0.0.1, I needed to edit /etc/resolv.conf (inside Lxroot).
• After editing /etc/resolve.conf, dig was able to successfully query DNS.

[ghost]

I removed Plop Linux's resolv.conf and replaced with a copy of the host's resolv.conf. Everything is fine now. But I have one question. How can you make /tmp inside lxroot writable? I have checked this tmp directory outside of lxroot. It's still owned by root but the files created by me during lxroot still have the correct permissions of my normal user account.

[parke]

How can you make /tmp inside lxroot writable?

/tmp is writable for me.

$ ls -la ploplinux-desktop-25.2-x86_64/tmp/
total 0
drwxr-xr-x 1 hack hack   0 May 21 10:09 .
drwxr-xr-x 1 hack hack 116 Apr 15 21:44 ..

$ ../lxroot/bin/lxroot ploplinux-desktop-25.2-x86_64/ -- touch /tmp/foo

$ ls -la ploplinux-desktop-25.2-x86_64/tmp/
total 0
drwxr-xr-x 1 hack hack   6 May 21 10:09 .
drwxr-xr-x 1 hack hack 116 Apr 15 21:44 ..
-rw-r--r-- 1 hack hack   0 May 21 10:09 foo

I have checked this tmp directory outside of lxroot. It's still owned by root ...

Why is /tmp owned by root? I thought you ran tar as a non-root user? And tar would have created ploplinux-desktop-25.2-x86_64/tmp/?

... but the files created by me during lxroot still have the correct permissions of my normal user account.

Perhaps if you sent me the command or commands that don't work as expected, I could provide more info?

Do you understand how UID mapping works inside Linux user namespaces? Specifically, do you understand the following:

$ ../lxroot/bin/lxroot ploplinux-desktop-25.2-x86_64/ -- ls -la /tmp
total 0
drwxr-xr-x 1 1005 1005   6 May 21 10:09 .
drwxr-xr-x 1 1005 1005 116 Apr 15 21:44 ..
-rw-r--r-- 1 1005 1005   0 May 21 10:09 foo

$ ../lxroot/bin/lxroot --root ploplinux-desktop-25.2-x86_64/ -- ls -la /tmp
total 0
drwxr-xr-x 1 root root   6 May 21 10:09 .
drwxr-xr-x 1 root root 116 Apr 15 21:44 ..
-rw-r--r-- 1 root root   0 May 21 10:09 foo

The files are always owned by hack, with UID 1005. But when you enter a namespace, UID 1005 can be remapped and appear to be different. (In this case, UID 1005 is mapped to UID 0.) But on the host system (i.e. outside the namespace), all the files are always owned by UID 1005. So you need to think about how UIDs can look different outside versus inside the namespace.

[ghost]

Yes, /tmp is also writable to me inside lxroot, even if I extracted the tar with sudo! This is like magic to me. Outside of lxroot, I run ls -la on ploplinux-desktop-25.2-x86_64/tmp. This directory is still owned by root, the the files created by me during lxroot are owned by my normal user account! lxroot was run with my normal user account (unprivileged), how can you do it?

p/s: I forgot to add the detail that I extracted the tar with sudo. I did it as a test and surprisingly lxroot can still work. /home/$USER is not writable, though. I have to update ploplinux-desktop-25.2-x86_64/etc/resolv.conf and create ploplinux-desktop-25.2-x86_64/home/$USER and chown it to my normal user account outside of lxroot. This is the reason why I think a writable /tmp inside lxroot is weird. I don't even need to chown it to my normal user account outside of lxroot.

[ghost]

All of this seems to be a security issue to me (write to a root owned directory without being root). Please try to extract the tar with sudo and see if you can reproduce it. Thank you.

p/s: I run mount inside lxroot and found that there are two entries of /tmp and they are exactly the same:

/dev/sda1 on /tmp type btrfs ...
/dev/sda1 on /tmp type btrfs ...

[parke]

All of this seems to be a security issue to me (write to a root owned directory without being root). Please try to extract the tar with sudo and see if you can reproduce it. Thank you.

/tmp is owned by root and world writable on almost every *nix system. This is in no way a security issue.

$ ls -ld /tmp /root
drwx------ 1 root root 270 Jan 28 10:53 /root
drwxrwxrwt 7 root root 140 May 22 00:04 /tmp

/root is also owned by root. Try writing to /root instead. You won't be able to.

p/s: I run mount inside lxroot and found that there are two entries of /tmp and they are exactly the same:

/dev/sda1 on /tmp type btrfs ...
/dev/sda1 on /tmp type btrfs ...

Thanks for pointing that out. It might be bug in Lxroot. I'm not sure. I'll try to look into it at some point. The double mount is probably not going to cause any problems. Only the second of the two mounts will be visible.

[ghost]

Hi. I have another question. Can you try to build a simple OpenGL program on Plop Linux inside lxroot? Plop Linux puts GL/GL.h in /opt/include, not /usr/include. I found that it doesn't work for me. But it works with chroot. I don't know what's going on.

It's always error with:

fatal error: GL/gl.h: No such file or directory
    1 | #include <GL/gl.h>
      |          ^~~~~~~~~
compilation terminated.

There will be no problem if I use chroot instead of lxroot.

[parke]

Can you try to build a simple OpenGL program on Plop Linux inside lxroot?

Please provide:

• the source code you are trying to compile
• the command(s) you run to compile the code
• the user ID and username of the user who runs the compile command

Some things to try:

• extract the Plop tarball as non-root
• run Lxroot with the -r or --root option
• alternatively, run: lxroot -nw ${newroot} -- fakeroot ${compile_command}

[ghost]

Try an empty C program with just #include <GL/gl.h>. The problem is it can't find GL/gl.h when using lxroot but it can when I use chroot. On Plop Linux, they put GL/gl.h in /opt/include, not /usr/include.

[ghost]

None of the things you suggested will work, as the problem has nothing to do with simulating the root user.

[parke]

Please run gcc -xc -E -v - in both chroot and lxroot and compare the results.

More info here:
https://www.baeldung.com/linux/gcc-default-include-directories

Update: By the way: When I try to compile in Lxroot, I do get the same compile time OpenGL error that you do.

[parke]

Fyi, I am going to try running the ISO of Plop Linux in QEMU. That will be easier for me than using chroot.

[parke]

Fyi, I get the same compilation error when running the Plop Linux ISO in QEMU.

[root@ploplinux ~]# echo '#include <GL/gl.h>' > test.c

[root@ploplinux ~]# gcc test.c
test.c:1:10: fatal error: GL/gl.h: No such file or directory
    1 | #include <GL/gl.h>
      |          ^~~~~~~~~
compilation terminated.

[root@ploplinux /]# ls -lh /opt/include/GL/gl.h
-rw-r--r-- 1 root root 79K Jan  7 12:44 /opt/include/GL/gl.h

[ghost]

OK. I give up on building software on Plop Linux. Now I have another question. It seems lxroot supports running of graphical applications. Do you see /opt/vivaldi on ploplinux-desktop-25.2-x86_64? I want to run it. Please tell me what to do.

p/s: I'm using the plain old Xorg, not Wayland.

[parke]

OK. I give up on building software on Plop Linux.

What software would you like to build?

Now I have another question. It seems lxroot supports running of graphical applications. Do you see /opt/vivaldi on ploplinux-desktop-25.2-x86_64? I want to run it. Please tell me what to do.

p/s: I'm using the plain old Xorg, not Wayland.

Great! Lxroot only supports Xorg! I've never tried using Lxroot on top of Wayland.

I cannot test it right now, but try this:

$ lxroot -npx $newroot -- /opt/vivaldi/vivaldi

The -p assumes that you are using Pulseaudio for sound.

[ghost]

I will run xcalc before trying complex application like vivaldi.

lxroot  error  target directory not found
  'ploplinux-desktop-25.2-x86_64/run/user/1000/pulse'

If remove -p:

lxroot  error  target directory not found
  'ploplinux-desktop-25.2-x86_64/tmp/.X11-unix'

BTW, my system is using pipewire. But I also have pipewire-pulse (the PulseAudio replacement daemon).

[ghost]

Is Xorg support actually in your unpublished version? Xorg support in the current version seems pretty much to be broken to me.

[parke]

Xorg support should be able to work. I haven't had time to investigate yet.

You could try manually creating both of the missing directories.

mkdir -p ploplinux-desktop-25.2-x86_64/run/user/1000/pulse
mkdir -p ploplinux-desktop-25.2-x86_64/tmp/.X11-unix

The published version of Lxroot may not automatically create those directories for you.

Let me know if that works. If it does not work, I will investigate further.

[parke]

Fyi, regarding OpenGL:

If Plop Linux installs header files in /opt/include, then something needs to tell gcc where to look for those header files.

Perhaps the most common way is the using -I option. There may be other ways. (I am not a gcc expert.) Typically, this type of configuration and management of the build system is handled by the package manager, by GNU Autotools, or by the Makefile. But it looks like Plop Linux uses a collection of build scripts instead of a formal package manager.

An example:

$ cat test.c 
#include <GL/gl.h>

$ gcc -I/opt/include test.c
/usr/lib/gcc/x86_64-pc-linux-gnu/13.3.0/../../../../x86_64-pc-linux-gnu/bin/ld: /usr/lib/gcc/x86_64-pc-linux-gnu/13.3.0/../../../../lib64/crt1.o: in function `_start':
(.text+0x17): undefined reference to `main'
collect2: error: ld returned 1 exit status

[ghost]

gcc -I/opt/include -L/opt/lib

[parke]

I'm glad that you figured out that -L may also be required!