mi/werkator
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Record the webspace's bwrap and kernel versions, and the glibc consequence

Browse Source 
bubblewrap 0.8.0 covers every option the sandbox design uses; only overlayfs is
missing, which the design does not need. The kernel version, however, points at
Debian 12 and thus a glibc older than the dev machine's, which would break the
jlink runtime bundle on that host -- noted as a check to run before deploying.

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
mhoennig
2026-08-11 10:21:00 +02:00
co-authored by Claude
parent 3f93882dda
commit c77de1c725
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/plan/17-bwrap-build-runtime.md
+7 -1
View File
@@ -39,7 +39,13 @@ touch: cannot touch '/usr/ro-test': Read-only file system
All three signals as expected — root inside the namespace, mapped back to the unprivileged webspace uid, and the read-only root bind enforced. All three signals as expected — root inside the namespace, mapped back to the unprivileged webspace uid, and the read-only root bind enforced.
So unprivileged user namespaces are available on Hostsharing Managed Webspaces and the step can proceed. So unprivileged user namespaces are available on Hostsharing Managed Webspaces and the step can proceed.
Not captured with it: the `bwrap` and kernel versions of that host — take them along when the implementation starts, in case a mount option turns out to need a minimum version. The host runs `bubblewrap 0.8.0` on kernel `6.1.0-52-amd64`.
Every option of the invocation below exists in 0.8.0 (`--die-with-parent` since 0.4.0, the rest is older), so the design stands as written.
What 0.8.0 lacks is overlayfs (`--overlay`, added in 0.9.0): a future "throwaway writable rootfs per build" cannot be built from an overlay here, only from tmpfs mounts over the writable spots.
**Consequence for the runtime bundle — verify before deploying:** kernel 6.1 means Debian 12 and therefore most likely glibc 2.36, while the dev machine builds the jlink bundle against glibc 2.39.
ADR 0006 requires building on glibc ≤ the target's, which holds for vm4006 (2.41) but not for such a webspace — the JRE would fail to start.
Confirm with `ldd --version` on the target and, if it is below 2.39, build the bundle in an older base image (e.g. `eclipse-temurin:21-jdk-jammy`, glibc 2.35) instead of on the dev machine.
## Goal ## Goal