landrun adds overhead

[bmwiedemann]

I packaged landrun for openSUSE and in testing it, found that landrun adds considerable overhead.

> time /usr/bin/touch /tmp/foo

real    0m0.002s
user    0m0.002s
sys     0m0.000s

> time landrun --rox /usr --rw /tmp /usr/bin/touch /tmp/foo

real    0m0.005s
user    0m0.004s
sys     0m0.002s

Also strace -f output has 1091 lines compared to 122 lines without landrun, including 4 clone3 calls where I only expected 1.

My guess is that goroutines are involved there.

[bmwiedemann]

An environment variable of GOMAXPROCS=1 could help a bit, but even an empty go program still creates 3 extra threads then, so part of it might be an issue in go's defaults.

[Zouuup]

Yeah, that's -as you said- runtime overhead of Go, but when we actually call syscall.Exec, no overhead remains because the process itself is replaced.

Thanks for packaging for OpenSUSE, feel free to send a PR with details! we do have a listing of packages in README

[TotallyGamerJet]

I noticed that the binary built in the GitHub Releases and the packaged one for OpenSUSE have Cgo enabled and are dynamically linked. Idk if that is intentional. I don't have OpenSUSE to test but it may be faster if built with CGO_ENABLED=0 since it won't try to create a C thread.

/usr/bin/landrun: go1.24.2
	path	command-line-arguments
	dep	github.com/cpuguy83/go-md2man/v2	v2.0.5	
	dep	github.com/landlock-lsm/go-landlock	v0.0.0-20250303204525-1544bccde3a3	
	dep	github.com/russross/blackfriday/v2	v2.1.0	
	dep	github.com/urfave/cli/v2	v2.27.6	
	dep	github.com/xrash/smetrics	v0.0.0-20240521201337-686a1a2994c1	
	dep	github.com/zouuup/landrun	(devel)	
	dep	golang.org/x/sys	v0.26.0	
	dep	kernel.org/pub/linux/libs/security/libcap/psx	v1.2.70	
	build	-buildmode=pie
	build	-compiler=gc
	build	-trimpath=true
	build	DefaultGODEBUG=asynctimerchan=1,gotestjsonbuildtext=1,gotypesalias=0,httplaxcontentlength=1,httpmuxgo121=1,httpservecontentkeepheaders=1,multipathtcp=0,netedns0=0,panicnil=1,randseednop=0,rsa1024min=0,tls10server=1,tls3des=1,tlsmlkem=0,tlsrsakex=1,tlsunsafeekm=1,winreadlinkvolume=0,winsymlink=0,x509keypairleaf=0,x509negativeserial=1,x509rsacrt=0,x509usepolicies=0
	build	CGO_ENABLED=1
	build	GOARCH=amd64
	build	GOOS=linux
	build	GOAMD64=v1

[bmwiedemann]

Yes, CGO_ENABLED=0 helps to reduce the overhead by 26%. I measured 100 execs:
plain touch: 222759 us
landrun (CGO_ENABLED=1): 455488 us
landrun (CGO_ENABLED=0): 394578 us

Another hint I got on reddit was https://github.com/tinygo-org/tinygo that avoided clone calls for a hello-world.go . Still need to test it with landrun.

[bmwiedemann]

I now got it built with tinygo - that got it down to 356803 us (-42% compared to the original build)