Fail with a more useful warning when --output_base=/tmp/something

Fix the documentation to not suggest using /tmp for output_base

PiperOrigin-RevId: 311110102

site/docs/user-manual.html

@@ -2723,24 +2723,8 @@ <h4 id='flag--output_base'><code class='flag'>--output_base=<var>dir</var></code
 </p>
 
 <p>For example:</p>
-<pre>
-  % bazel --output_base /tmp/1 build //foo  &amp;  bazel --output_base /tmp/2 build //bar
-</pre>
-<p>
-  In this command, the two Bazel commands run concurrently (because of
-  the shell <code>&amp;</code> operator), each using a different Bazel
-  server instance (because of the different output bases).
-  In contrast, if the default output base was used in both commands,
-  then both requests would be sent to the same server, which would
-  handle them sequentially: building <code>//foo</code> first, followed
-  by an incremental build of <code>//bar</code>.
-</p>
-<p>
-  We recommend you do not use NFS locations for the output base, as
-  the higher access latency of NFS will cause noticeably slower
-  builds.
-</p>
-
+<pre><code>
+  OUTPUT_BASE=/var/tmp/google/_bazel_johndoe/custom_output_base
 <h4 id='flag--output_user_root'><code class='flag'>--output_user_root=<var>dir</var></code></h4>
 <p>
   By default, the <code>output_base</code> value is chosen to as to

src/main/tools/linux-sandbox-pid1.cc

@@ -175,6 +175,19 @@ static void MountFilesystems() {
   // do this is by bind-mounting it upon itself.
   PRINT_DEBUG("working dir: %s", opt.working_dir.c_str());
 
+  // An attempt to mount the sandbox in tmpfs will always fail, so this block is
+  // slightly redundant with the next mount() check, but dumping the mount()
+  // syscall is incredibly cryptic, so we explicitly check against and warn
+  // about attempts to use tmpfs.
+  for (const std::string &tmpfs_dir : opt.tmpfs_dirs) {
+    if (opt.working_dir.find(tmpfs_dir) == 0) {
+      DIE("The sandbox working directory cannot be below a path where we mount "
+          "tmpfs (you requested mounting %s in %s). Is your --output_base= "
+          "below one of your --sandbox_tmpfs_path values?",
+          opt.working_dir.c_str(), tmpfs_dir.c_str());
+    }
+  }
+
   if (mount(opt.working_dir.c_str(), opt.working_dir.c_str(), nullptr, MS_BIND,
             nullptr) < 0) {
     DIE("mount(%s, %s, nullptr, MS_BIND, nullptr)", opt.working_dir.c_str(),