zuul
/
zuul
Code Issues Proposed changes

Merge "Optionally bind /lib64" into feature/zuulv3

This commit is contained in:
Jenkins 2017-07-07 23:16:49 +00:00 committed by Gerrit Code Review
parent 35a63901ab 7206a511e4
commit d7931836fb
1 changed files with 35 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

61
zuul/driver/bubblewrap/__init__.py
View File

@ -70,34 +70,11 @@ class BubblewrapDriver(Driver, WrapperInterface):
name = 'bubblewrap'
log = logging.getLogger("zuul.BubblewrapDriver")
bwrap_command = [
'bwrap',
'--dir', '/tmp',
'--tmpfs', '/tmp',
'--dir', '/var',
'--dir', '/var/tmp',
'--dir', '/run/user/{uid}',
'--ro-bind', '/usr', '/usr',
'--ro-bind', '/lib', '/lib',
'--ro-bind', '/lib64', '/lib64',
'--ro-bind', '/bin', '/bin',
'--ro-bind', '/sbin', '/sbin',
'--ro-bind', '/etc/resolv.conf', '/etc/resolv.conf',
'--ro-bind', '{ssh_auth_sock}', '{ssh_auth_sock}',
'--dir', '{work_dir}',
'--bind', '{work_dir}', '{work_dir}',
'--dev', '/dev',
'--chdir', '{work_dir}',
'--unshare-all',
'--share-net',
'--die-with-parent',
'--uid', '{uid}',
'--gid', '{gid}',
'--file', '{uid_fd}', '/etc/passwd',
'--file', '{gid_fd}', '/etc/group',
]
mounts_map = {'rw': [], 'ro': []}
def __init__(self):
self.bwrap_command = self._bwrap_command()
def reconfigure(self, tenant):
pass
@ -160,6 +137,38 @@ class BubblewrapDriver(Driver, WrapperInterface):
return wrapped_popen
def _bwrap_command(self):
bwrap_command = [
'bwrap',
'--dir', '/tmp',
'--tmpfs', '/tmp',
'--dir', '/var',
'--dir', '/var/tmp',
'--dir', '/run/user/{uid}',
'--ro-bind', '/usr', '/usr',
'--ro-bind', '/lib', '/lib',
'--ro-bind', '/bin', '/bin',
'--ro-bind', '/sbin', '/sbin',
'--ro-bind', '/etc/resolv.conf', '/etc/resolv.conf',
'--ro-bind', '{ssh_auth_sock}', '{ssh_auth_sock}',
'--dir', '{work_dir}',
'--bind', '{work_dir}', '{work_dir}',
'--dev', '/dev',
'--chdir', '{work_dir}',
'--unshare-all',
'--share-net',
'--die-with-parent',
'--uid', '{uid}',
'--gid', '{gid}',
'--file', '{uid_fd}', '/etc/passwd',
'--file', '{gid_fd}', '/etc/group',
]
if os.path.isdir('/lib64'):
bwrap_command.extend(['--ro-bind', '/lib64', '/lib64'])
return bwrap_command
def main(args=None):
logging.basicConfig(level=logging.DEBUG)