From 3f93882dda7f847f4acec5e00a8f4ff422d087cb Mon Sep 17 00:00:00 2001 From: mhoennig Date: Tue, 11 Aug 2026 10:19:21 +0200 Subject: [PATCH] Record the passing bwrap precondition check on a Managed Webspace Plan step 17 hinges on unprivileged user namespaces being usable on a Hostsharing Managed Webspace. The check ran on h68 and passed with all three expected signals, so the step is viable there and the sandbox design stands. Co-Authored-By: Claude --- docs/plan/17-bwrap-build-runtime.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/docs/plan/17-bwrap-build-runtime.md b/docs/plan/17-bwrap-build-runtime.md index 333c9dc..86932f0 100644 --- a/docs/plan/17-bwrap-build-runtime.md +++ b/docs/plan/17-bwrap-build-runtime.md @@ -29,6 +29,18 @@ Expected output: If this fails (`bwrap` missing, "setting up uid map: Permission denied", or no user namespace support), the approach is dead on that host — record the result in this file either way. +**Result: passed** on 2026-08-11, Hostsharing Managed Webspace `h68`, user `mih00`: + +``` +0 + 0 102147 1 +touch: cannot touch '/usr/ro-test': Read-only file system +``` + +All three signals as expected — root inside the namespace, mapped back to the unprivileged webspace uid, and the read-only root bind enforced. +So unprivileged user namespaces are available on Hostsharing Managed Webspaces and the step can proceed. +Not captured with it: the `bwrap` and kernel versions of that host — take them along when the implementation starts, in case a mount option turns out to need a minimum version. + ## Goal A third build runtime behind the `BuildRunner` interface: `BwrapBuildRunner`, selected per branch via config, sandboxing the build in an unprivileged user namespace with a prepared Debian root filesystem.