{"payload":{"feedbackUrl":"https://github.com/orgs/community/discussions/53140","repo":{"id":767026633,"defaultBranch":"main","name":"nomad-driver-exec2","ownerLogin":"hashicorp","currentUserCanPush":false,"isFork":false,"isEmpty":false,"createdAt":"2024-03-04T15:16:25.000Z","ownerAvatar":"https://avatars.githubusercontent.com/u/761456?v=4","public":true,"private":false,"isOrgOwned":true},"refInfo":{"name":"","listCacheKey":"v0:1717607632.0","currentOid":""},"activityList":{"items":[{"before":"f207a0f5786f59e7e342f540aca1edefcf533aa0","after":null,"ref":"refs/heads/release/0.1.0-alpha.1","pushedAt":"2024-06-05T17:13:52.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"shoenig","name":"Seth Hoenig","path":"/shoenig","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/394887?s=80&v=4"}},{"before":"acef2c48fa9f16fbf6273ed35406d6e5cb257a03","after":null,"ref":"refs/heads/release/0.1.0-beta.1","pushedAt":"2024-06-05T17:11:58.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"shoenig","name":"Seth Hoenig","path":"/shoenig","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/394887?s=80&v=4"}},{"before":"58bc54b8b772c9c9a41c821b079e2174a3f4ca5e","after":"85bbe16c4937bc2ae41256c7746b8e7b25b807c1","ref":"refs/heads/main","pushedAt":"2024-06-05T17:11:57.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"shoenig","name":"Seth Hoenig","path":"/shoenig","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/394887?s=80&v=4"},"commit":{"message":"release/0.1.0 beta.1 (#36)\n\n* Release v0.1.0-beta.1\r\n\r\n* Prepare for next release","shortMessageHtmlLink":"release/0.1.0 beta.1 (#36)"}},{"before":"e30fcd5461cb9a6e3e0f2e012ae10c84a5b3bf5f","after":"acef2c48fa9f16fbf6273ed35406d6e5cb257a03","ref":"refs/heads/release/0.1.0-beta.1","pushedAt":"2024-06-05T17:04:28.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"shoenig","name":"Seth Hoenig","path":"/shoenig","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/394887?s=80&v=4"},"commit":{"message":"Prepare for next release","shortMessageHtmlLink":"Prepare for next release"}},{"before":null,"after":"e30fcd5461cb9a6e3e0f2e012ae10c84a5b3bf5f","ref":"refs/heads/release/0.1.0-beta.1","pushedAt":"2024-06-05T14:58:33.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"shoenig","name":"Seth Hoenig","path":"/shoenig","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/394887?s=80&v=4"},"commit":{"message":"Release v0.1.0-beta.1","shortMessageHtmlLink":"Release v0.1.0-beta.1"}},{"before":"08aa12efbaa7f870d7520120d49734a8850c12db","after":null,"ref":"refs/heads/readme-bin-clarifications","pushedAt":"2024-06-05T14:39:53.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"shoenig","name":"Seth Hoenig","path":"/shoenig","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/394887?s=80&v=4"}},{"before":"d4f6295dee21c632d8a607716b8ab47b82f5d9bc","after":"58bc54b8b772c9c9a41c821b079e2174a3f4ca5e","ref":"refs/heads/main","pushedAt":"2024-06-05T14:39:53.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"shoenig","name":"Seth Hoenig","path":"/shoenig","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/394887?s=80&v=4"},"commit":{"message":"readme: clarify what bin files are auto unveiled (#35)\n\nFixes #19","shortMessageHtmlLink":"readme: clarify what bin files are auto unveiled (#35)"}},{"before":"21009d8f6cebf7a7255d8d7ab57046f15abbf3d0","after":null,"ref":"refs/heads/readme-py-java-examples","pushedAt":"2024-06-05T14:39:42.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"shoenig","name":"Seth Hoenig","path":"/shoenig","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/394887?s=80&v=4"}},{"before":"82fd63affa6e28f7d85145f9124d5e81d81ac434","after":"d4f6295dee21c632d8a607716b8ab47b82f5d9bc","ref":"refs/heads/main","pushedAt":"2024-06-05T14:39:41.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"shoenig","name":"Seth Hoenig","path":"/shoenig","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/394887?s=80&v=4"},"commit":{"message":"readme: add python and java examples (#34)","shortMessageHtmlLink":"readme: add python and java examples (#34)"}},{"before":"785817ac71ae7cffa3e3bd44479331b3fab6a449","after":"21009d8f6cebf7a7255d8d7ab57046f15abbf3d0","ref":"refs/heads/readme-py-java-examples","pushedAt":"2024-06-05T13:42:42.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"shoenig","name":"Seth Hoenig","path":"/shoenig","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/394887?s=80&v=4"},"commit":{"message":"readme: add python and java examples","shortMessageHtmlLink":"readme: add python and java examples"}},{"before":null,"after":"08aa12efbaa7f870d7520120d49734a8850c12db","ref":"refs/heads/readme-bin-clarifications","pushedAt":"2024-06-05T13:38:05.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"shoenig","name":"Seth Hoenig","path":"/shoenig","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/394887?s=80&v=4"},"commit":{"message":"readme: clarify what bin files are auto unveiled\n\nFixes #19","shortMessageHtmlLink":"readme: clarify what bin files are auto unveiled"}},{"before":"51a6a406d61a29a9aefe3436bd7557b1399f075f","after":null,"ref":"refs/heads/negative-sandbox-write-tests","pushedAt":"2024-06-05T13:27:33.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"shoenig","name":"Seth Hoenig","path":"/shoenig","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/394887?s=80&v=4"}},{"before":"5dead3aa20578747b248026a7692d5439e1b17ad","after":"82fd63affa6e28f7d85145f9124d5e81d81ac434","ref":"refs/heads/main","pushedAt":"2024-06-05T13:27:32.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"shoenig","name":"Seth Hoenig","path":"/shoenig","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/394887?s=80&v=4"},"commit":{"message":"driver: add tests that fail to write into the tasks own sandbox (#33)\n\nIf unveil_defaults is not set, it should not be possible to write into\r\nthe task's own sandbox. In this case the task should be configured with\r\nits own sandbox as one of its unveil paths.","shortMessageHtmlLink":"driver: add tests that fail to write into the tasks own sandbox (#33)"}},{"before":null,"after":"785817ac71ae7cffa3e3bd44479331b3fab6a449","ref":"refs/heads/readme-py-java-examples","pushedAt":"2024-06-05T13:26:55.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"shoenig","name":"Seth Hoenig","path":"/shoenig","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/394887?s=80&v=4"},"commit":{"message":"readme: add python and java examples","shortMessageHtmlLink":"readme: add python and java examples"}},{"before":null,"after":"51a6a406d61a29a9aefe3436bd7557b1399f075f","ref":"refs/heads/negative-sandbox-write-tests","pushedAt":"2024-06-05T13:02:12.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"shoenig","name":"Seth Hoenig","path":"/shoenig","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/394887?s=80&v=4"},"commit":{"message":"driver: add tests that fail to write into the tasks own sandbox\n\nIf unveil_defaults is not set, it should not be possible to write into\nthe task's own sandbox. In this case the task should be configured with\nits own sandbox as one of its unveil paths.","shortMessageHtmlLink":"driver: add tests that fail to write into the tasks own sandbox"}},{"before":"f21380d76ddca223e226a0e2df56e424c1ea4101","after":null,"ref":"refs/heads/auto-unveil-fixes","pushedAt":"2024-06-04T19:51:53.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"shoenig","name":"Seth Hoenig","path":"/shoenig","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/394887?s=80&v=4"}},{"before":"0f4e19ba0c0513581edb72d8e4f09cb92d8e6127","after":"5dead3aa20578747b248026a7692d5439e1b17ad","ref":"refs/heads/main","pushedAt":"2024-06-04T19:51:52.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"shoenig","name":"Seth Hoenig","path":"/shoenig","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/394887?s=80&v=4"},"commit":{"message":"config: unveil NOMAD_* paths if unveil_defaults is set (#32)\n\nThis PR changes the driver such that NOMAD_TASK_DIR, NOMAD_ALLOC_DIR, and\r\nNOMAD_SECRETS_DIR are automatically unveil'd with rwxc permissions if\r\nthe plugin `config.unveil_defaults` value is set. Previously we would do\r\nthis if and only if the task's `config.unveil` value was empty, which does\r\nnot make sense.\r\n\r\nAlso re-enable test cases that were disabled when we fixed the /tmp\r\nunveil behavior. The unit tests had to be tweaked to actually resolve\r\nthe environment variables at run time because the testing harness does\r\nnot do that and figuring out how to make it work was too hard.","shortMessageHtmlLink":"config: unveil NOMAD_* paths if unveil_defaults is set (#32)"}},{"before":"a19c04c2e7a425b79c0f6502e20c0821fac70840","after":"f21380d76ddca223e226a0e2df56e424c1ea4101","ref":"refs/heads/auto-unveil-fixes","pushedAt":"2024-06-04T17:04:32.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"shoenig","name":"Seth Hoenig","path":"/shoenig","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/394887?s=80&v=4"},"commit":{"message":"config: unveil NOMAD_* paths if unveil_defaults is set\n\nThis PR changes the driver such that NOMAD_TASK_DIR, NOMAD_ALLOC_DIR, and\nNOMAD_SECRETS_DIR are automatically unveil'd with rwxc permissions if\nthe plugin `config.unveil_defaults` value is set. Previously we would do\nthis if and only if the task's `config.unveil` value was empty, which does\nnot make sense.\n\nAlso re-enable test cases that were disabled when we fixed the /tmp\nunveil behavior. The unit tests had to be tweaked to actually resolve\nthe environment variables at run time because the testing harness does\nnot do that and figuring out how to make it work was too hard.","shortMessageHtmlLink":"config: unveil NOMAD_* paths if unveil_defaults is set"}},{"before":"f44e27ca6b677507e224d0dfeafdfc8d23ab3c62","after":"a19c04c2e7a425b79c0f6502e20c0821fac70840","ref":"refs/heads/auto-unveil-fixes","pushedAt":"2024-06-04T16:53:41.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"shoenig","name":"Seth Hoenig","path":"/shoenig","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/394887?s=80&v=4"},"commit":{"message":"config: unveil NOMAD_* paths if unveil_defaults is set\n\nThis PR changes the driver such that NOMAD_TASK_DIR, NOMAD_ALLOC_DIR, and\nNOMAD_SECRETS_DIR are automatically unveil'd with rwxc permissions if\nthe plugin `config.unveil_defaults` value is set. Previously we would do\nthis if and only if the task's `config.unveil` value was empty, which does\nnot make sense.\n\nAlso re-enable test cases that were disabled when we fixed the /tmp\nunveil behavior. The unit tests had to be tweaked to actually resolve\nthe environment variables at run time because the testing harness does\nnot do that and figuring out how to make it work was too hard.","shortMessageHtmlLink":"config: unveil NOMAD_* paths if unveil_defaults is set"}},{"before":null,"after":"f44e27ca6b677507e224d0dfeafdfc8d23ab3c62","ref":"refs/heads/auto-unveil-fixes","pushedAt":"2024-06-04T16:52:07.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"shoenig","name":"Seth Hoenig","path":"/shoenig","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/394887?s=80&v=4"},"commit":{"message":"config: unveil NOMAD_* paths if unveil_defaults is set\n\nThis PR changes the driver such that NOMAD_TASK_DIR, NOMAD_ALLOC_DIR, and\nNOMAD_SECRETS_DIR are automatically unveil'd with rwxc permissions if\nthe plugin `config.unveil_defaults` value is set. Previously we would do\nthis if and only if the task's `config.unveil` value was empty, which does\nnot make sense.","shortMessageHtmlLink":"config: unveil NOMAD_* paths if unveil_defaults is set"}},{"before":"7d2310d960e768075e3acacdd4f44a09a838c83c","after":null,"ref":"refs/heads/disallow-tmp-in-defaults","pushedAt":"2024-06-04T14:05:39.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"shoenig","name":"Seth Hoenig","path":"/shoenig","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/394887?s=80&v=4"}},{"before":"819d2f6d2ee2a08dca3f19596dc783ce62a046b6","after":"0f4e19ba0c0513581edb72d8e4f09cb92d8e6127","ref":"refs/heads/main","pushedAt":"2024-06-04T14:05:38.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"shoenig","name":"Seth Hoenig","path":"/shoenig","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/394887?s=80&v=4"},"commit":{"message":"exec2: do not allow /tmp as part of the defaults (#31)\n\n* exec2: do not allow /tmp as part of the defaults\r\n\r\nThis PR removes the unveil-ing of /tmp at rwc permission level as part\r\nof the `unveil_defaults` plugin configuration.\r\n\r\nA task sandbox already has a tmp directory created and is pointed to by\r\nthe standard TMPDIR environment variable; compliant tools should already\r\nbe using it.\r\n\r\nDisallowing /tmp by default improves two things\r\n- /tmp is readable and writable by all users (i.e. 777) and is an easy\r\nplace for other processes to leak information.\r\n- /tmp is not accounted for in the task sandbox disk quota and may even\r\nbe tmpfs, wasting memory if a task is writing lots of temp data\r\n\r\nA task that wants to make use of the real /tmp can do so if the operator\r\nadds /tmp to the plugin unveil_paths configuration, or if unveil_by_task\r\nis set in plugin configuration and the task adds /tmp to its unveil paths\r\nlist.\r\n\r\n* tests: temporarily skip tests that need fix for #29","shortMessageHtmlLink":"exec2: do not allow /tmp as part of the defaults (#31)"}},{"before":"9d219d06b2610e509b73be607d03f122d5674a26","after":"7d2310d960e768075e3acacdd4f44a09a838c83c","ref":"refs/heads/disallow-tmp-in-defaults","pushedAt":"2024-06-04T13:57:07.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"shoenig","name":"Seth Hoenig","path":"/shoenig","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/394887?s=80&v=4"},"commit":{"message":"tests: temporarily skip tests that need fix for #29","shortMessageHtmlLink":"tests: temporarily skip tests that need fix for #29"}},{"before":null,"after":"9d219d06b2610e509b73be607d03f122d5674a26","ref":"refs/heads/disallow-tmp-in-defaults","pushedAt":"2024-06-04T13:42:48.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"shoenig","name":"Seth Hoenig","path":"/shoenig","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/394887?s=80&v=4"},"commit":{"message":"exec2: do not allow /tmp as part of the defaults\n\nThis PR removes the unveil-ing of /tmp at rwc permission level as part\nof the `unveil_defaults` plugin configuration.\n\nA task sandbox already has a tmp directory created and is pointed to by\nthe standard TMPDIR environment variable; compliant tools should already\nbe using it.\n\nDisallowing /tmp by default improves two things\n- /tmp is readable and writable by all users (i.e. 777) and is an easy\nplace for other processes to leak information.\n- /tmp is not accounted for in the task sandbox disk quota and may even\nbe tmpfs, wasting memory if a task is writing lots of temp data\n\nA task that wants to make use of the real /tmp can do so if the operator\nadds /tmp to the plugin unveil_paths configuration, or if unveil_by_task\nis set in plugin configuration and the task adds /tmp to its unveil paths\nlist.","shortMessageHtmlLink":"exec2: do not allow /tmp as part of the defaults"}},{"before":"2404bee18b02889c5e52e74c009ff491ecda00fb","after":null,"ref":"refs/heads/b-typo-in-package-build","pushedAt":"2024-06-04T13:05:46.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"pkazmierczak","name":"Piotr Kazmierczak","path":"/pkazmierczak","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/470696?s=80&v=4"}},{"before":"1426af03b9fbae0e2d432c33da50494d6759b4a3","after":"819d2f6d2ee2a08dca3f19596dc783ce62a046b6","ref":"refs/heads/main","pushedAt":"2024-06-04T13:05:45.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"pkazmierczak","name":"Piotr Kazmierczak","path":"/pkazmierczak","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/470696?s=80&v=4"},"commit":{"message":"build: fix typo in package build workflow (#30)\n\nOtherwise deb/rpm packages aren't named correctly.","shortMessageHtmlLink":"build: fix typo in package build workflow (#30)"}},{"before":null,"after":"2404bee18b02889c5e52e74c009ff491ecda00fb","ref":"refs/heads/b-typo-in-package-build","pushedAt":"2024-06-04T08:28:50.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"pkazmierczak","name":"Piotr Kazmierczak","path":"/pkazmierczak","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/470696?s=80&v=4"},"commit":{"message":"build: fix typo in package build workflow\n\nOtherwise deb/rpm packages aren't named correctly.","shortMessageHtmlLink":"build: fix typo in package build workflow"}},{"before":"2821ea7c8457b14de20ae5bfbdd5ef7353a26a3f","after":null,"ref":"refs/heads/release/0.1.0-alpha.2","pushedAt":"2024-05-28T14:02:59.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"shoenig","name":"Seth Hoenig","path":"/shoenig","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/394887?s=80&v=4"}},{"before":"53d22b2d6b847a5bf84044e0da325eb29dd013d0","after":"1426af03b9fbae0e2d432c33da50494d6759b4a3","ref":"refs/heads/main","pushedAt":"2024-05-28T14:02:58.000Z","pushType":"pr_merge","commitsCount":1,"pusher":{"login":"shoenig","name":"Seth Hoenig","path":"/shoenig","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/394887?s=80&v=4"},"commit":{"message":"Release/0.1.0 alpha.2 (#28)\n\n* Release v0.1.0-alpha.2\r\n\r\n* Prepare for next release","shortMessageHtmlLink":"Release/0.1.0 alpha.2 (#28)"}},{"before":"93d36b0b769c74860159e53270342fef567c9a66","after":"2821ea7c8457b14de20ae5bfbdd5ef7353a26a3f","ref":"refs/heads/release/0.1.0-alpha.2","pushedAt":"2024-05-28T13:12:21.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"shoenig","name":"Seth Hoenig","path":"/shoenig","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/394887?s=80&v=4"},"commit":{"message":"Prepare for next release","shortMessageHtmlLink":"Prepare for next release"}}],"hasNextPage":true,"hasPreviousPage":false,"activityType":"all","actor":null,"timePeriod":"all","sort":"DESC","perPage":30,"cursor":"djE6ks8AAAAEXWGdPgA","startCursor":null,"endCursor":null}},"title":"Activity ยท hashicorp/nomad-driver-exec2"}