Support mounting the host filesystem read-only in the sandbox

[BuildStream-Migration-Bot]

See original issue on GitLab
In GitLab by [Gitlab user @aperezdc] on Feb 9, 2017, 15:30

It would be interesting to support bind-mounting the host filesystem read-only. This way instead of necessarily having to pull a root filesystem tarball (or an OSTree sysroot), it would be possible to reuse the development tools from the host. This is interesting in cases where one would want to build software to run in the host which gets built and installed by BuildStream in a prefix.

For example, right now for WebKitGTK+ development we currently use a custom jhbuild module set to ensure all developers use the same dependencies for testing, and we do want the build artifacts to be built with the host compiler and installed into a directory, because the rest of the WebKitGTK+ build system and the test runner expect to use host tools as well.

[BuildStream-Migration-Bot]

In GitLab by [Gitlab user @tristanvb] on Feb 10, 2017, 08:30

Sealing off the build from your host is quite central to our plans and I'm quite convinced that for any tooling or dependencies that you might have on your host, it's possible to have them in a sealed and deterministic build environment as well.

This does not entirely preclude building things with the intention of running them on your host, for this a Flatpak, Snap or even an AppImage deployment can be used. Yes, this is expensive in bandwidth and disk space (but will be made less so with artifact cache sharing in place), but this is a small price to pay for eliminating the uncertainty (and bugs) that comes with using host tooling with weak minimal bound dependency models.

For what it's worth, in other tooling we had something called "bootstrap mode" which allowed this for the purpose of rolling the compiler and base runtime but it was certainly a source of bugs, and it's a pain point that we can eliminate. This example shows that even at bootstrap time there is no need for host tooling.

...because the rest of the WebKitGTK+ build system and the test runner expect to use host tools as well

This should really be transparent to the build system and test runner, can you provide an example of what you expect will work correctly using host tooling but is not possible from a deterministic sysroot ?

[BuildStream-Migration-Bot]

In GitLab by [Gitlab user @tristanvb] on Feb 16, 2017, 07:16

Closing this, as no-host-tools is a design choice which comes with some tradeoffs, which we believe will prove to be the correct tradeoffs.

[BuildStream-Migration-Bot]

In GitLab by [Gitlab user @tristanvb] on Feb 16, 2017, 07:16

closed