Prefer bubblewrap for network isolation

[tiran]

Bubblewrap is another tool for unsharing namespaces. It sets up a network namespace with a disconnected loopback.

Fixes: #472

[dhellmann]

This looks OK for now. We should consider if this should be configurable by the user somehow, but this at least lets us move forward.

Edit: nvm. I tested it and it seems to work -- see comments below about adding --privileged to docker and fixing the --unshare-net option.

[prarit]

Let's try this and see if it works better. OOC do you test if it solved the MPI issue in a container?

[tiran]

Let's try this and see if it works better. OOC do you test if it solved the MPI issue in a container?

$ bwrap --unshare-net --dev-bind / / -- /usr/lib64/openmpi/bin/mpicc -showme:compile
-I/usr/include/openmpi-x86_64

$ unshare -rn -- /usr/lib64/openmpi/bin/mpicc -showme:compile
[hostname:1498104] opal_ifinit: unable to find network interfaces.
-I/usr/include/openmpi-x86_64

[prarit]

--unshare-network doesn't appear to be valid? Is this supposed to be --unshare-net ?

[prarit]

FYI: this needs docker to specify --privileged in builder's bin/boostrap.sh o/w you get an error

bwrap: Creating new namespace failed: Operation not permitted

[tiran]

bwrap does not work for us. It requires additional permissions and adjustments to work in an unprivileged container. We want a system that works in podman out of the box and in docker with minimal adjustments.