#!/usr/bin/execlineb -P
# "foreground", not "pipeline": both separate commands, but pipeline means
# "feed the block's output into the rest" -- the daemon at the end of the chain
# inherited an already closed pipe from s6-mkdir as stdin. What was meant was
# simply "create the directory first, then continue" (finding from the
# execline audit of all run scripts, 2026-09-22; it was not broken, but it
# read as if a pipe were intended).
foreground { s6-mkdir -p /var/lib/incus-lxcfs }

# Best-effort OOM protection: adjust our own PID inside foreground{} so the
# EACCES in unprivileged containers (no CAP_SYS_RESOURCE) doesn't abort the run.
getpid OURPID
importas -u OURPID OURPID
foreground { choom -n -1000 -p ${OURPID} }

# Readiness: fuse.lxcfs is mounted (data/check), every 1 s for up to 60 s.
s6-notifyoncheck -d -w 1000 -n 60 --
run-script-daemon incus-lxcfs
