#!/bin/sh
# 00-early-mount.sh — Mount essential virtual filesystems

# After switch_root, /proc /sys /dev are already mounted — only mount if missing
if ! mountpoint -q /proc 2>/dev/null; then
    mount -t proc proc /proc 2>/dev/null || true
fi
if ! mountpoint -q /sys 2>/dev/null; then
    mount -t sysfs sysfs /sys 2>/dev/null || true
fi
if ! mountpoint -q /dev 2>/dev/null; then
    mount -t devtmpfs devtmpfs /dev 2>/dev/null || mount -t tmpfs tmpfs /dev
fi
if ! mountpoint -q /tmp 2>/dev/null; then
    mount -t tmpfs -o noexec,nosuid,nodev,size=256M tmpfs /tmp
fi
if ! mountpoint -q /run 2>/dev/null; then
    mount -t tmpfs -o nosuid,nodev,size=64M tmpfs /run
fi

mkdir -p /dev/pts /dev/shm
if ! mountpoint -q /dev/pts 2>/dev/null; then
    mount -t devpts devpts /dev/pts
fi
if ! mountpoint -q /dev/shm 2>/dev/null; then
    mount -t tmpfs -o noexec,nosuid,nodev,size=64M tmpfs /dev/shm
fi

# Ensure essential device nodes exist (devtmpfs may be incomplete after switch_root)
[ -e /dev/console ] || mknod -m 600 /dev/console c 5 1 2>/dev/null || true
[ -e /dev/null ]    || mknod -m 666 /dev/null c 1 3 2>/dev/null || true
[ -e /dev/zero ]    || mknod -m 666 /dev/zero c 1 5 2>/dev/null || true
[ -e /dev/kmsg ]    || mknod -m 660 /dev/kmsg c 1 11 2>/dev/null || true
[ -e /dev/random ]  || mknod -m 666 /dev/random c 1 8 2>/dev/null || true
[ -e /dev/urandom ] || mknod -m 666 /dev/urandom c 1 9 2>/dev/null || true
[ -e /dev/tty ]     || mknod -m 666 /dev/tty c 5 0 2>/dev/null || true

# Set up BusyBox mdev as hotplug handler (creates /dev nodes for new devices)
echo /sbin/mdev > /proc/sys/kernel/hotplug 2>/dev/null || true
mdev -s 2>/dev/null || true

# Mount cgroup v2 unified hierarchy
mkdir -p /sys/fs/cgroup
if ! mountpoint -q /sys/fs/cgroup 2>/dev/null; then
    mount -t cgroup2 cgroup2 /sys/fs/cgroup 2>/dev/null || true
fi

# Enable ALL available controllers for child cgroups
# Required: memory (memory.max), cpu (cpu.max), pids (pids.max)
# First, move init process to its own cgroup so controllers can be enabled
# (cgroup v2 "no internal process" rule for non-root cgroups)
if [ -f /sys/fs/cgroup/cgroup.controllers ]; then
    mkdir -p /sys/fs/cgroup/init
    echo $$ > /sys/fs/cgroup/init/cgroup.procs 2>/dev/null || true
    for ctrl in $(cat /sys/fs/cgroup/cgroup.controllers); do
        echo "+${ctrl}" > /sys/fs/cgroup/cgroup.subtree_control 2>/dev/null || true
    done
fi

# Mount BPF filesystem (required for cgroup v2 device control via BPF)
mkdir -p /sys/fs/bpf
mount -t bpf bpf /sys/fs/bpf 2>/dev/null || true