Repository navigation
Sandbox execution on Linux - #2241
Merged
Merged
Conversation
chrisstaite
force-pushed
the
container_run
branch
from
March 23, 2026 20:36
cc3d5b1 to
f4ee8d8
Compare
chrisstaite
force-pushed
the
container_run
branch
from
March 23, 2026 20:52
f4ee8d8 to
e43aeff
Compare
chrisstaite
force-pushed
the
container_run
branch
from
March 23, 2026 21:03
e43aeff to
6611cfd
Compare
chrisstaite
force-pushed
the
container_run
branch
from
March 23, 2026 21:19
6611cfd to
826050e
Compare
chrisstaite
force-pushed
the
container_run
branch
from
March 23, 2026 21:20
826050e to
de32f62
Compare
chrisstaite
force-pushed
the
container_run
branch
from
March 23, 2026 21:30
de32f62 to
4a88afc
Compare
chrisstaite
force-pushed
the
container_run
branch
from
March 23, 2026 21:36
4a88afc to
dfec500
Compare
chrisstaite
force-pushed
the
container_run
branch
from
March 23, 2026 21:53
dfec500 to
b6dbbc3
Compare
chrisstaite
force-pushed
the
container_run
branch
from
March 23, 2026 21:54
b6dbbc3 to
ca60c58
Compare
chrisstaite
force-pushed
the
container_run
branch
from
March 23, 2026 22:22
ca60c58 to
2a41f12
Compare
chrisstaite
force-pushed
the
container_run
branch
from
March 23, 2026 23:35
824e9d7 to
dcc15e7
Compare
chrisstaite
force-pushed
the
container_run
branch
from
March 23, 2026 23:35
dcc15e7 to
0d9e8bf
Compare
chrisstaite
force-pushed
the
container_run
branch
from
March 23, 2026 23:42
0d9e8bf to
61f29cc
Compare
chrisstaite
force-pushed
the
container_run
branch
from
March 23, 2026 23:52
61f29cc to
97f429c
Compare
palfrey
reviewed
Mar 24, 2026
Contributor
Author
|
Don't know why the mongo store tests are failing, they work locally. |
Contributor
Author
|
They were apparently depending on the fact that sandboxing was broken in Bazel due to the apparmor_restrict_unprivileged_userns setting. I have re-broken this for the Bazel runs, but it's still enabled for the Cargo version to ensure it's an actually tested code path. |
Contributor
Author
|
I've refactored into a separate module and written full safety comments for each unsafe call. I'm happy with this now, it will absolutely resolve the issue of #225 if it's activated. |
palfrey
reviewed
Mar 25, 2026
Member
|
/build-image nativelink-worker-init |
Member
|
/build-image |
Contributor
|
Image built and pushed! |
Contributor
|
Image built and pushed! |
Contributor
Author
|
I've updated this to send SIGTERM when namespaced to avoid the zombie issue. |
When executing on Linux there are issues with running as the init process and not reaping children. This is incompatible with the Tokio runtime. Therefore, in the pre_exec we fork a new process which becomes the init process for that execution. We can do this by making use of user namespacing. Since we're namespacing anyway, include the UTS and IPC namespaces to isolate the execution even more and make it more reproducible.
Contributor
Author
|
I've created zombie tests and also made sure the kill signal is raised correctly from the child. So that's nice. Also, the rebase fix-up is complete too. All ready to merge now. |
palfrey
approved these changes
Mar 26, 2026
This was referenced Mar 27, 2026
This was referenced Jun 2, 2026
Closed
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
When executing on Linux there are issues with running as the init process and not reaping children. This is incompatible with the Tokio runtime.
Therefore, in the pre_exec we fork a new process which becomes the init process for that execution. We can do this by making use of user namespacing. Since we're namespacing anyway, include the UTS and IPC namespaces to isolate the execution even more and make it more reproducible.
Type of change
Please delete options that aren't relevant.
How Has This Been Tested?
Tests are passing with and without the activation of the feature.
Checklist
bazel test //...passes locallygit amendsee some docsThis change is