mi/werkator
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Record the passing bwrap precondition check on a Managed Webspace

Browse Source 
Plan step 17 hinges on unprivileged user namespaces being usable on a
Hostsharing Managed Webspace. The check ran on h68 and passed with all three
expected signals, so the step is viable there and the sandbox design stands.

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
mhoennig
2026-08-11 10:19:21 +02:00
co-authored by Claude
parent 021d97eca8
commit 3f93882dda
1 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/plan/17-bwrap-build-runtime.md
+12
View File
@@ -29,6 +29,18 @@ Expected output:
If this fails (`bwrap` missing, "setting up uid map: Permission denied", or no user namespace support), the approach is dead on that host — record the result in this file either way.
**Result: passed** on 2026-08-11, Hostsharing Managed Webspace `h68`, user `mih00`:
```
0
0 102147 1
touch: cannot touch '/usr/ro-test': Read-only file system
```
All three signals as expected — root inside the namespace, mapped back to the unprivileged webspace uid, and the read-only root bind enforced.
So unprivileged user namespaces are available on Hostsharing Managed Webspaces and the step can proceed.
Not captured with it: the `bwrap` and kernel versions of that host — take them along when the implementation starts, in case a mount option turns out to need a minimum version.
## Goal
A third build runtime behind the `BuildRunner` interface: `BwrapBuildRunner`, selected per branch via config, sandboxing the build in an unprivileged user namespace with a prepared Debian root filesystem.