--close-fd would fail to work on some systems when entering spacetimes where /proc would not be mounted, because it would attempt to iterate over all file descriptors as listed in /proc/self/fd right before execve, and of course this cannot work when /proc isn't there.
This fixes the problem by doing the operation earlier, after the setup script has ran, but before pivoting roots; of course, we can't close the range outright, since we're likely to use some of these file descriptors, but we can instead set the CLOEXEC bit on them.
--close-fd would fail to work on some systems when entering spacetimes where /proc would not be mounted, because it would attempt to iterate over all file descriptors as listed in /proc/self/fd right before execve, and of course this cannot work when /proc isn't there.
This fixes the problem by doing the operation earlier, after the setup script has ran, but before pivoting roots; of course, we can't close the range outright, since we're likely to use some of these file descriptors, but we can instead set the CLOEXEC bit on them.