mi/werkator
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

feat(config): the sandbox section is werkdock, not bwrap

Browse Source 
`bwrap` named the mechanism one layer below the tool that actually runs it: since
v1.0.0 Werkator does not invoke bwrap at all, it shells out to the werkdock CLI —
which made `bwrap.werkdock` a key naming its own executor.

The section is `werkdock` now and that key is `werkdock.binary`; BwrapConfig,
BwrapOverrides and BwrapBuildRunner follow the name. A file still writing `bwrap`
is read as before and warned about once per file, in `renameLegacySandbox` on the
raw map of every layer before merging — so nothing downstream knows two names, and
the old name is not a way around the pinning either. Renaming rather than refusing,
because the section lives in the machine configuration of every webspace instance,
which no repository tracks; the hard refusal belongs to the release that sets
ConfigVersions.FORMAT_BROKE_IN, where a file declaring no version can be caught
by name at all.

WERKATOR_SANDBOX in tools/remote follows, and still accepts `bwrap`.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
mhoennig
2026-09-03 20:27:16 +02:00
co-authored by Claude Opus 5
parent 95564587d3
commit 34af8ba1bf
16 changed files with 242 additions and 120 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/remote
+9 -5
View File
@@ -50,8 +50,9 @@
# unit, exactly as `init --systemd` derives it
# WERKATOR_INSTALL_DIR directory holding the unpacked runtime bundle, absolute or
# relative to WERKATOR_PATH (default: .werkator)
# WERKATOR_SANDBOX build runtime of the host: bwrap (default) or docker; a docker
# host needs neither the werkdock binary nor a rootfs archive
# WERKATOR_SANDBOX build runtime of the host: werkdock (default, the bubblewrap
# sandbox; `bwrap` is accepted as its former name) or docker —
# a docker host needs neither the werkdock binary nor a rootfs
# WERKDOCK_REPO checkout of the werkdock repository, whose binary the
# instance runs (default: <repo>/../werkdock)
# WERKDOCK_BINARY the built werkdock binary (default: $WERKDOCK_REPO/dist/werkdock)
@@ -137,10 +138,13 @@ REPO_DIR="$(resolve_dir "${WERKATOR_REPO_DIR:-werkator}")"
INSTALL_DIR="$(resolve_dir "${WERKATOR_INSTALL_DIR:-.werkator}")"
# where `repo-add` puts a further repository of the registry: beside the watched one
SIBLING_DIR="$(dirname "$REPO_DIR")"
SANDBOX="${WERKATOR_SANDBOX:-bwrap}"
SANDBOX="${WERKATOR_SANDBOX:-werkdock}"
# `bwrap` was the name of the config section until Werkator v1.2.0; accepted so an env
# file written for the older script keeps working, normalised so only one name is used.
[ "$SANDBOX" = "bwrap" ] && SANDBOX="werkdock"
case "$SANDBOX" in
bwrap|docker) ;;
*) die "WERKATOR_SANDBOX is 'bwrap' or 'docker', not '$SANDBOX'" ;;
werkdock|docker) ;;
*) die "WERKATOR_SANDBOX is 'werkdock' or 'docker', not '$SANDBOX'" ;;
esac
MACHINE_CONFIG="$REPO_DIR/.git/werkator/.werkator.yml"