Test nested sandboxing, and make nicer error#8696
Merged
Ericson2314 merged 1 commit intoNixOS:masterfrom Jul 14, 2023
Merged
Conversation
github-actions
bot
added
the
with-tests
Ericson2314
force-pushed
the
nested-sandboxing
branch
from
5e477eb to
990b27c
Compare
roberth
reviewed
Jul 14, 2023
| local storeFun=$1 | ||
| local count=$2 | ||
| nix-build \ | ||
| --no-substitute --no-out-link \ |
Member
There was a problem hiding this comment.
OT: nix should detect that it's in the non-FOD sandbox and turn these things off by itself.
Ericson2314
force-pushed
the
nested-sandboxing
branch
from
8af286e to
93f2953
Compare
We were bedeviled by sandboxing issues when working on the layered store. The problem ended up being that when we have nested nix builds, and the inner store is inside the build dir (e.g. store is `/build/nix-test/$name/store`, build dir is `/build`) bind mounts clobber each other and store paths cannot be found. After thoroughly cleaning up `local-derivation-goal.cc`, we might be able to make that work. But that is a lot of work. For now, we just fail earlier with a proper error message. Finally, test this: nested sandboxing without the problematic store dir should work, and with should fail with the expected error message. Co-authored-by: Dylan Green <[email protected]> Co-authored-by: Robert Hensing <[email protected]>
Ericson2314
force-pushed
the
nested-sandboxing
branch
from
93f2953 to
0f7242f
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
We were bedeviled by sandboxing issues when working on the layered store. The problem ended up being that when we have nested nix builds, and the inner store is inside the build dir (e.g. store is
/build/nix-test/$name/store, build dir is/build) bind mounts clobber each other and store paths cannot be found.After thoroughly cleaning up
local-derivation-goal.cc, we might be able to make that work. But that is a lot of work. For now, we just fail earlier with a proper error message.Finally, test this: nested sandboxing without the problematic store dir should work, and with should fail with the expected error message.
Context
Came from work on NixOS/rfcs#152, but not actually part of that feature, good to merge either way.
Checklist for maintainers
Maintainers: tick if completed or explain if not relevant
tests/**.shsrc/*/teststests/nixos/*Priorities
Add 👍 to pull requests you find important.