Custom sandboxing implementation as linux usernamespace calls - port cachepot/#128 #1628
Conversation
Codecov ReportPatch coverage has no change and project coverage change:
Additional details and impacted files@@ Coverage Diff @@
## main #1628 +/- ##
==========================================
+ Coverage 29.75% 29.92% +0.17%
==========================================
Files 49 49
Lines 16661 16659 -2
Branches 8065 8057 -8
==========================================
+ Hits 4957 4985 +28
+ Misses 6790 6786 -4
+ Partials 4914 4888 -26
Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here. ☔ View full report at Codecov. |
|
@sylvestre |
sylvestre
changed the title
* WIP: Implement build sandboxing using unshared user namespaces * Don't derive Debug when not needed * Gate the new unshared user namespace behind CACHEPOT_SANDBOX env var * Minimize diff * Remove a trailing comma * Clean up CI and temp. allow unprivileged dist tests to fail * Simulate allow-failure in GHA * ci: oops, GHA uses ! for negation * Fetch gid correctly and use effective IDs to mimic `unshare`'s behavior * WIP: See if GHA will be fixed now * Warn if overlay build failed * Actually, GHA using unprivileged user namespaces works! * Revert .gitlab-ci.yml Don't run relevant test in CI for now; we don't want to mark the test suite as red in GH for the time being * Address review feedback
sylvestre
force-pushed
the
bernhard-port-cachepot-128
branch
from
9a7c723
to
9fb6a25
Compare
|
dunno much about this one but I guess it is working with cachepot, why not :) |
|
It does work, I'll add some documentation once the safety concern in in the comments is addressed - it should be considered experimental. |
Implementes a custom sandboxing implementation as linux usernamespace calls.
It's opt-in, and has to be enabled with setting the
SCCACHE_SANDBOXenvironment variable.Ref #1620
Original work done by @Xanewok