feat: refactor /etc mounts

[frezbo]

Stop using individual bind mounts for /etc files and use an overlay backed by rootfs /etc and an anonymous tmpfs. This allows in future to support files under /etc as machine config documents.

Drop all bind mount support, containers now also follow same pattern.

Also move /etc/cni and /etc/kuberentes as tmpfs, since we cannot have a nested overlay over size of two, when system has an extension(s), /etc being an overlay means, it's already two levels in, so /etc/cni and /etc/kubernetes cannot be overlayed on top again.

[Copilot]

Pull request overview

Refactors Talos’ /etc handling to stop using per-file bind mounts and instead compose /etc as a read-only overlay backed by the static rootfs /etc plus a writable (anonymous) tmpfs, with /etc/cni and /etc/kubernetes mounted as standalone tmpfs due to overlay stacking limits (especially when extensions add additional overlay layers).

Changes:

• Added fsopen support for ordered FSCONFIG_SET_FD parameters and introduced an overlay helper that builds overlay lower layers from mount FDs.
• Added machined runtime logic to seed required /etc files/dirs and mount the /etc overlay early, then mount writable tmpfs on /etc/cni and /etc/kubernetes.
• Removed /etc bind-mount machinery in controllers/tests and adjusted SELinux policy + rootfs build steps to match the new /etc model.

Reviewed changes

Copilot reviewed 14 out of 15 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
pkg/xfs/fsopen/options_linux.go	Adds WithFdParameter option to pass FSCONFIG_SET_FD parameters into fsopen.
pkg/xfs/fsopen/fsopen_linux.go	Stores ordered fd params and applies them via unix.FsconfigSetFd during filesystem creation.
pkg/machinery/constants/constants.go	Removes /etc/cni and /etc/kubernetes from the generic overlay mount list.
internal/pkg/selinux/policy/selinux/services/kubelet.cil	Allows filesystem association for k8s_conf_t to support context-labeled tmpfs mounts.
internal/pkg/selinux/policy/selinux/services/cri.cil	Adds tmpfs association for cni_conf_t and allows container runtime remount behavior for k8s_conf_t.
internal/pkg/selinux/policy/selinux/common/files.cil	Labels managed /etc tmpfs as etc_t, adds filesystem association, and introduces a neverallow guard against non-init writes to etc_t.
internal/pkg/mount/v3/helpers.go	Adds helper to mount read-only overlay using layer file descriptors (fsconfig lowerdir+ via FD).
internal/app/machined/pkg/runtime/v1alpha2/v1alpha2_controller.go	Switches /etc to a managed tmpfs + overlay model and wires in overlay setup.
internal/app/machined/pkg/runtime/v1alpha2/etc_overlay.go	New implementation that seeds /etc, mounts the /etc overlay, and mounts writable tmpfs at /etc/cni and /etc/kubernetes.
internal/app/machined/pkg/controllers/files/etcfile.go	Removes per-file bind mounts; writes directly into the managed /etc tmpfs root.
internal/app/machined/pkg/controllers/files/etcfile_test.go	Updates tests to validate writes into EtcRoot only (overlay surfacing is now machined’s responsibility).
internal/app/machined/pkg/controllers/files/cri_registry_config.go	Drops bind mount creation for CRI hosts directory; relies on overlay surfacing.
internal/app/machined/pkg/controllers/block/internal/volumes/volumeconfig/system_volumes.go	Minor formatting change while iterating overlay volume resources.
Dockerfile	Stops pre-creating many /etc placeholders in the rootfs; only keeps extensions.yaml placeholder.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[rothgar]

Would storing /etc/cni as tmpfs mean cni plugins would need to be re-copied on every system reboot?

[frezbo]

Would storing /etc/cni as tmpfs mean cni plugins would need to be re-copied on every system reboot?

no, plugins are in /opt

[Copilot]

Pull request overview

Copilot reviewed 17 out of 18 changed files in this pull request and generated 3 comments.