Allow configuring sandbox option casd-socket#1945
Allow configuring sandbox option casd-socket#1945nanonyme wants to merge 1 commit intoapache:masterfrom
Conversation
This declares path in sandbox where casd socket will be mounted to
nanonyme
requested review from
BenjaminSchubert,
abderrahim,
cs-shadow,
gtristan and
juergbi
as code owners
|
Exposing the unfiltered buildbox-casd socket would result in exposing access to the host filesystem via the LocalCAS protocol. An option that may be safe (to be reviewed) would be to change the instance name to a random token, generated in each BuildStream session, and then use Ideally, REAPI upstream would define a standard way how REAPI access can be exposed to a the action command. This shouldn't be buildbox-casd-specific and should also be supported with remote execution. Maybe configured by platform property. |
I'm not sure how this works: does it create a "sandboxed" instance somehow or is it just to have the LocalCas methods apply on the sandbox instead of the host? But this indeed needs to put some thoughts on what exactly we want to provide to the sandboxes: just CAS? CAS and action cache? do we need remote asset too? (we need to at least restrict what can be requested from remote asset). How about remote execution? maybe not by default, but it's probably what would give the most performance benefit. How about LocalCAS? do we need to restrict that? |
That's kind of the same thing, isn't it? Is there a particular difference between the two options that needs to be clarified? As mentioned, we should review the code to make sure it's sufficiently sandboxed, though.
Yes, we certainly need to give this some more thought. |
I meant is access to the CAS somehow sandboxed? (from your answer I guess it's not). Not that I think it should be, I just wanted clarification. |
| else: | ||
| stdin = subprocess.DEVNULL | ||
|
|
||
| if "casd-socket" in self.__config: |
There was a problem hiding this comment.
This is probably a mistake: self.__config doesn't seem to exist here.
There was a problem hiding this comment.
Hmm, is it the name mangling? self.__config belongs to grandparent of this class, Sandbox.
There was a problem hiding this comment.
Yeah, anything that starts with two underscores is private to a class (and python enforces it)
|
Is it fair to say that #2014, which appears more complete, although in draft state, replaces this ? |
|
Yes, #2014 replaces this PR. |
4 participants
This declares path in sandbox where casd socket will be mounted to. Continuation of #1772