FailFS is a pseudo-filesystem expected to land in Linux 7.3 that returns EOPNOTSUPP on every single operation. That is not a bug. It is the entire design. Mount it as a process root and absolute paths fail, absolute symlinks fail, relative paths fail. The classic /lib64/ld-linux-x86-64.so.2 dynamic loader reference breaks too, meaning ordinary ELF binaries cannot launch without additional setup.
The security model inverts the standard sandboxing approach. Traditional isolation starts with a full filesystem and subtracts access via mount namespaces, bind mounts, and chroots. FailFS starts with nothing. A sandbox manager opens specific directories, hands those file descriptors to the process, and the process reaches files only via calls like openat(). Anything without an explicitly supplied descriptor does not exist. The article also covers FailFS's sibling NULLFS, introduced earlier, which returns ENOENT instead of EOPNOTSUPP and was built to clean up pivot_root() operations.
Read the full piece for the technical walkthrough of how pathname lookup breaks step by step inside FailFS, and why the ELF loader problem is more nuanced than it first appears. The honest caveat is also worth your time: FailFS controls filesystem access and nothing else. Syscalls, networking, IPC, and inherited descriptors remain untouched.
[READ ORIGINAL →]