fix(image-factory): say which device is missing, and check both

Follows tool.sh giving the factory the host's /dev. These are for a factory
started by hand without it, and for the case that survives either way: the
module not being loaded on the host at all.

Three failures instead of one message. No /dev/loop-control means the loop
module is not loaded, and loading it inside here would not help since this
/dev is not the host's. No node for the loop device the kernel handed out means
a copied /dev, which now says so - and names the first-build-only symptom,
because "it worked the second time" reads like a ghost otherwise. No
/dev/mapper/control is the same cause one step later, and was worth catching
before kpartx does.

mount_image.sh had no check at all: a failed losetup left LOOPDEV empty and the
error surfaced as 'kpartx -av ""'.

Signed-off-by: Simon Walz <contact@simonwalz.de>

Author: simonwalz

image-factory/create_image.sh

@@ -165,11 +165,16 @@ sync
 
 # Setup loop device
 #
-# The kernel hands out a free loop number through /dev/loop-control, but the
-# matching /dev/loopN node only exists if something creates it - and in a
-# container there is no udev to do that. losetup then fails with ENOENT and
-# reports the device node as "lost". Creating the node is enough to get past
-# that, provided the container may use block devices at all.
+# This container's /dev is a snapshot of the host's, taken when the container
+# started - 'docker run --privileged' enumerates the host's devices once and
+# creates them in here. A device the kernel makes afterwards therefore exists on
+# the host and not in this container, and asking for a free loop device is
+# exactly that: /dev/loop-control hands out a number, and the node for it never
+# appears. losetup then fails with ENOENT and calls the node "lost".
+#
+# It bites on the first build of a machine, where no loop device existed when
+# the container started, and stops biting on the second, where one did.
+# Creating the node ourselves is enough wherever we are allowed to.
 attach_loop_device() {
   local dev
   dev="$(losetup --find --show "${IMAGE}" 2>/dev/null)" || dev=""
@@ -197,31 +202,60 @@ for _attempt in 1 2 3; do
 done
 
 if [[ -z "${LOOPDEV}" ]]; then
+  if [[ ! -e /dev/loop-control ]]; then
+    raise "There is no /dev/loop-control, so no loop device can be asked for.
+
+       The loop module is not loaded on the build host, or it was not loaded
+       when this container started. On the host:
+
+         sudo modprobe loop
+
+       then build again. Loading it inside the container does not help: this
+       container's /dev was taken from the host at start and does not follow it."
+  fi
+
   raise "Could not attach ${IMAGE} to a loop device.
 
-       Building a disk image needs loop devices, device-mapper and the right to
-       mount filesystems. All three belong to the host kernel, and an LXC
-       container has none of them by default - a 'device node /dev/loopN is
-       lost' above means the kernel did hand out a loop device, but this
-       container has no node for it.
+       The kernel did hand out a loop device - 'device node /dev/loopN is lost'
+       above says so - but this container has no node for it, and creating one
+       was not permitted either.
+
+       On a normal host or VM this only happens on the very first build, before
+       any loop device exists. Load the module on the host and build again:
 
-       Build on a host or in a VM instead. If it has to be this container, it
-       must be privileged and unconfined, and its config needs at least:
+         sudo modprobe loop dm_mod
+
+       Inside an LXC container it happens every time, because loop devices,
+       device-mapper and mounting all belong to the host kernel. Build on a host
+       or in a VM instead; if it has to be that container, it must be privileged
+       and unconfined, with at least:
 
          lxc.apparmor.profile: unconfined
          lxc.cgroup2.devices.allow: b 7:* rwm
          lxc.cgroup2.devices.allow: c 10:237 rwm
          lxc.mount.entry: /dev/loop-control dev/loop-control none bind,create=file
          lxc.mount.entry: /dev/loop0 dev/loop0 none bind,create=file
 
-       plus one bind entry per loop device you want available. Note that
-       device-mapper is the next thing this script needs, and it has the same
-       kind of problem.
+       plus one bind entry per loop device wanted.
 
        Building for '--platform lxc' needs none of this: it exports a container
        rather than partitioning a disk."
 fi
 
+# Device-mapper is the next thing needed, and it is the same story: kpartx maps
+# the image's partitions through it, and /dev/mapper/control has to be here.
+if [[ ! -e /dev/mapper/control ]]; then
+  raise "There is no /dev/mapper/control, so the partitions of ${IMAGE} cannot
+       be mapped.
+
+       Same cause as a missing loop device: this container's /dev was taken from
+       the host when it started. On the host:
+
+         sudo modprobe dm_mod
+
+       then build again."
+fi
+
 partprobe "${LOOPDEV}"
 
 # Map partitions

image-factory/mount_image.sh

@@ -31,7 +31,17 @@ if [[ ! -d "${OUTPUT_DIR}" ]]; then
 fi
 
 # Setup loop device
-LOOPDEV="$(losetup --find --show $IMAGE)"
+if ! LOOPDEV="$(losetup --find --show "${IMAGE}")" || [[ -z "${LOOPDEV}" ]]; then
+	raise "Could not attach ${IMAGE} to a loop device.
+
+       This needs the host's /dev, not the copy of it a privileged container
+       gets at start: the node for a loop device the kernel hands out now does
+       not exist in that copy. tool.sh mounts it; a factory started by hand
+       needs '-v /dev:/dev' too.
+
+       If /dev is mounted and this still fails, the loop module is not loaded on
+       the host: 'sudo modprobe loop dm_mod'."
+fi
 partprobe "${LOOPDEV}"
 
 # Map partitions