#!/bin/bash
set -euo pipefail
# /dev is supplied by the kernel/early userspace; s6 stage 1 mounts /run.
# Never remount SYSTEM writable.
mountpoint -q /proc || mount -t proc -o nosuid,nodev,noexec proc /proc
mountpoint -q /sys || mount -t sysfs -o nosuid,nodev,noexec sysfs /sys
mountpoint -q /tmp || mount -t tmpfs -o mode=1777,nosuid,nodev tmpfs /tmp
mountpoint -q /var/tmp || mount -t tmpfs -o mode=1777,nosuid,nodev tmpfs /var/tmp
mountpoint -q /var/log || mount -t tmpfs -o mode=0755,nosuid,nodev tmpfs /var/log
mountpoint -q /home/fds || mount -t tmpfs -o mode=0700,uid=1000,gid=1000,nosuid,nodev tmpfs /home/fds
mkdir -p /dev/pts /dev/shm /run/lock /run/log
mountpoint -q /dev/pts || mount -t devpts -o mode=0620,gid=5,nosuid,noexec devpts /dev/pts
mountpoint -q /dev/shm || mount -t tmpfs -o mode=1777,nosuid,nodev tmpfs /dev/shm
ln -snf /proc/self/fd /dev/fd
ln -snf /proc/self/fd/0 /dev/stdin
ln -snf /proc/self/fd/1 /dev/stdout
ln -snf /proc/self/fd/2 /dev/stderr
# Local TCP/UDP is base IPC. External interfaces remain down until requested.
ip link set dev lo up