From c77de1c72595b0ec6be326ff8b622629c63ca309 Mon Sep 17 00:00:00 2001 From: mhoennig Date: Tue, 11 Aug 2026 10:21:00 +0200 Subject: [PATCH] Record the webspace's bwrap and kernel versions, and the glibc consequence bubblewrap 0.8.0 covers every option the sandbox design uses; only overlayfs is missing, which the design does not need. The kernel version, however, points at Debian 12 and thus a glibc older than the dev machine's, which would break the jlink runtime bundle on that host -- noted as a check to run before deploying. Co-Authored-By: Claude --- docs/plan/17-bwrap-build-runtime.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/docs/plan/17-bwrap-build-runtime.md b/docs/plan/17-bwrap-build-runtime.md index 86932f0..78725fb 100644 --- a/docs/plan/17-bwrap-build-runtime.md +++ b/docs/plan/17-bwrap-build-runtime.md @@ -39,7 +39,13 @@ touch: cannot touch '/usr/ro-test': Read-only file system All three signals as expected — root inside the namespace, mapped back to the unprivileged webspace uid, and the read-only root bind enforced. So unprivileged user namespaces are available on Hostsharing Managed Webspaces and the step can proceed. -Not captured with it: the `bwrap` and kernel versions of that host — take them along when the implementation starts, in case a mount option turns out to need a minimum version. +The host runs `bubblewrap 0.8.0` on kernel `6.1.0-52-amd64`. +Every option of the invocation below exists in 0.8.0 (`--die-with-parent` since 0.4.0, the rest is older), so the design stands as written. +What 0.8.0 lacks is overlayfs (`--overlay`, added in 0.9.0): a future "throwaway writable rootfs per build" cannot be built from an overlay here, only from tmpfs mounts over the writable spots. + +**Consequence for the runtime bundle — verify before deploying:** kernel 6.1 means Debian 12 and therefore most likely glibc 2.36, while the dev machine builds the jlink bundle against glibc 2.39. +ADR 0006 requires building on glibc ≤ the target's, which holds for vm4006 (2.41) but not for such a webspace — the JRE would fail to start. +Confirm with `ldd --version` on the target and, if it is below 2.39, build the bundle in an older base image (e.g. `eclipse-temurin:21-jdk-jammy`, glibc 2.35) instead of on the dev machine. ## Goal