Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add additional sandbox modes #591

Merged
merged 17 commits into from
Oct 16, 2024
Merged

Conversation

jkloetzke
Copy link
Member

The --sandbox mode is nice but sometimes cumbersome to use. It will use stable paths (/bob/...) which is good for reproducibility but bad for debugging. OTOH, no isolation will be applied without a sandbox image. This PR adds a couple of other sandbox modes to make the usage more flexible:

  • --slim-sandbox: Applies isolation (e.g. make dependencies read-only) but do not use a sandbox image, even if available. Do not virtualize paths.
  • --dev-sandbox: Always apply isolation but use a sandbox image if available. Like the slim sandbox, do not virtualize paths.
  • --strict-sandbox: Always apply isolation, always use stable paths and use the sandbox image if available.

Copy link

codecov bot commented Oct 13, 2024

Codecov Report

Attention: Patch coverage is 95.81395% with 9 lines in your changes missing coverage. Please review.

Project coverage is 88.88%. Comparing base (0f55e6f) to head (c51d5de).
Report is 18 commits behind head on master.

Files with missing lines Patch % Lines
pym/bob/cmds/build/project.py 81.25% 3 Missing ⚠️
pym/bob/input.py 95.91% 2 Missing ⚠️
pym/bob/invoker.py 93.33% 2 Missing ⚠️
pym/bob/cmds/jenkins/jenkins.py 95.23% 1 Missing ⚠️
pym/bob/state.py 90.90% 1 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##           master     #591      +/-   ##
==========================================
+ Coverage   88.78%   88.88%   +0.09%     
==========================================
  Files          48       48              
  Lines       15144    15270     +126     
==========================================
+ Hits        13446    13572     +126     
  Misses       1698     1698              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@jkloetzke jkloetzke added this to the 0.25 milestone Oct 13, 2024
Hide it from "git grep" and similar commands.
Export the job configurations XML and verify that the plugin was
executed successfully.
Add the possibility to apply version dependent fix-ups when invoking hook
functions.
The usage of stable paths (/bob/...) has traditionally been bound to the
usage of a sandbox. This makes sense insofar as these virtual paths
depend on the usage of mount namespaces.

The new "stablePaths" option allows to override the usage of virtual,
stable paths. By default, the existing heuristic is retained. But the
usage of stable paths can be now forced or prohibited too.
The slim sandbox uses the bob-namespace-sandbox to restrict access to
workspace paths. But in contrast to the existing "fat" sandbox, a slim
sandbox does not use a sandbox image. To gain at least a bit of
information hiding, the current working directory is hidden behind a
whiteout. This should usually hide all other workspaces.
To introduce different sandbox modes, a SandboxMode helper is added.
This helper controls three different aspects of the sandbox operation:

* slimSandbox: use mount namespaces without a sandbox image.
* sandboxEnabled: usage of the sanbox image
* stablePaths: force or prohibit stable paths

Using these properties, the following sandbox modes are defined:

* no-sandbox
* sandbox: traditional sandbox mode
* slim-sandbox: always isolate, always use workspace path, not use
  sandbox images.
* dev-sandbox: always isolate, always use workspace path, use sandbox
  images if available.
* strict-sandbox: always isolate, always use stable paths, use sandbox
  images if available.
Adds the new --slim-sandbox, --dev-sandbox and --strict-sandbox options
to the dev/build commands.
Let the "sandbox" command default additionally accept the 'no', 'yes',
'slim', 'dev' and 'strict' strings that correspond to the respective
command line options.
Adds the new --slim-sandbox, --dev-sandbox and --strict-sandbox options
to the jenkins commands.
The function actually tests the usage of a sandbox image. This is an
important distinction because it won't return true in case of the slim
sandbox build mode. Likewise, it will return false in the dev- or
strict-sandbox modes when packages have no available sandbox image even
though isolation is applied.
The test incorrectly uses `--dev' as abbreviation for the '--develop'
option. While this worked so far, it will be ambiguous with the
introduction of the '--dev-sandbox' option.
This does not actually add any new behaviour. But it makes the remaining
commands consistent with the build/dev/jenkins commands by accepting the
same options.
@jkloetzke jkloetzke merged commit e683f9b into BobBuildTool:master Oct 16, 2024
11 checks passed
@jkloetzke jkloetzke deleted the sandbox-modes branch October 16, 2024 20:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant