Sandbox execution on Linux

.github/workflows/coverage.yaml

@@ -32,6 +32,11 @@ jobs:
       - name: Prepare Worker
         uses: ./.github/actions/prepare-nix
 
+      # Ubuntu 24.04 restricts unprivileged user namespaces by default, which breaks
+      # the worker tests that use namespaces (e.g. for sandboxing).
+      - name: Disable AppArmor namespace restrictions
+        run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+
       - name: Generate coverage
         run: |
           nix build -L .#nativelinkCoverageForHost

.github/workflows/native-cargo.yaml

@@ -37,6 +37,12 @@ jobs:
         uses: >- # v4.2.2
           actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
 
+      # Ubuntu 24.04 restricts unprivileged user namespaces by default, which breaks
+      # the worker tests that use namespaces (e.g. for sandboxing).
+      - name: Disable AppArmor namespace restrictions
+        run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+        if: matrix.os == 'ubuntu-24.04'
+
       - name: Set up Rust toolchain
         run: rustup update && rustup default ${{ matrix.toolchain }}
         shell: bash

nativelink-config/src/cas_server.rs

@@ -853,6 +853,13 @@ pub struct LocalWorkerConfig {
     /// them from CAS for every action.
     /// Default: None (directory cache disabled)
     pub directory_cache: Option<DirectoryCacheConfig>,
+
+    /// Whether to use namespaces to isolate the execution.  This is only available
+    /// on Linux.  It is highly recommended as it avoids a number of issues with
+    /// zombie processes and also provides additional hermeticity.  If explicitly set
+    /// to true and it is not supported the worker will exit with an error.
+    /// Default: False.
+    pub use_namespaces: Option<bool>,
 }
 
 #[derive(Deserialize, Serialize, Debug, Clone)]

nativelink-worker/BUILD.bazel

@@ -16,7 +16,10 @@ rust_library(
         "src/running_actions_manager.rs",
         "src/worker_api_client_wrapper.rs",
         "src/worker_utils.rs",
-    ],
+    ] + select({
+        "@platforms//os:linux": ["src/namespace_utils.rs"],
+        "//conditions:default": [],
+    }),
     proc_macro_deps = [
         "@crates//:async-trait",
     ],
@@ -46,14 +49,18 @@ rust_library(
         "@crates//:tonic",
         "@crates//:tracing",
         "@crates//:uuid",
-    ],
+    ] + select({
+        "@platforms//os:linux": ["@crates//:libc"],
+        "//conditions:default": [],
+    }),
 )
 
 rust_test_suite(
     name = "integration",
     timeout = "short",
     srcs = [
         "tests/local_worker_test.rs",
+        "tests/namespace_utils_test.rs",
         "tests/running_actions_manager_test.rs",
         "tests/worker_utils_test.rs",
     ],
@@ -88,7 +95,10 @@ rust_test_suite(
         "@crates//:tracing",
         "@crates//:tracing-test",
         "@crates//:which",
-    ],
+    ] + select({
+        "@platforms//os:linux": ["@crates//:libc"],
+        "//conditions:default": [],
+    }),
 )
 
 rust_test(

nativelink-worker/Cargo.toml

@@ -55,6 +55,9 @@ uuid = { version = "1.16.0", default-features = false, features = [
   "v4",
 ] }
 
+[target.'cfg(target_os = "linux")'.dependencies]
+libc = { version = "0.2.183", default-features = false }
+
 [dev-dependencies]
 nativelink-macro = { path = "../nativelink-macro" }
 

nativelink-worker/src/lib.rs

@@ -14,6 +14,8 @@
 
 pub mod directory_cache;
 pub mod local_worker;
+#[cfg(target_os = "linux")]
+pub mod namespace_utils;
 pub mod running_actions_manager;
 pub mod worker_api_client_wrapper;
 pub mod worker_utils;

nativelink-worker/src/local_worker.rs

@@ -598,6 +598,21 @@ pub async fn new_local_worker(
         None
     };
 
+    #[cfg(target_os = "linux")]
+    let use_namespaces = if let Some(use_namespaces) = &config.use_namespaces {
+        if *use_namespaces && !crate::namespace_utils::namespaces_supported() {
+            return Err(make_err!(Code::Unavailable, "Namespaces not supported"));
+        }
+        *use_namespaces
+    } else {
+        false
+    };
+
+    #[cfg(not(target_os = "linux"))]
+    if config.use_namespaces.is_some_and(core::convert::identity) {
+        return Err(make_err!(Code::Unavailable, "Namespaces not supported"));
+    }
+
     let running_actions_manager =
         Arc::new(RunningActionsManagerImpl::new(RunningActionsManagerArgs {
             root_action_directory: config.work_directory.clone(),
@@ -613,6 +628,8 @@ pub async fn new_local_worker(
             max_upload_timeout,
             timeout_handled_externally: config.timeout_handled_externally,
             directory_cache,
+            #[cfg(target_os = "linux")]
+            use_namespaces,
         })?);
     let local_worker = LocalWorker::new_with_connection_factory_and_actions_manager(
         config.clone(),