From db06d805ec92b0a101355056a303dcb730043450 Mon Sep 17 00:00:00 2001 From: mhoennig Date: Tue, 1 Sep 2026 08:09:03 +0200 Subject: [PATCH] bwrap: reset TMPDIR/TMP to /tmp inside the sandbox MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit bwrap inherits the server's environment; on hosts with pam_tmpdir that includes TMPDIR=/tmp/user/, which does not exist on the sandbox's fresh tmpfs /tmp. Every tool honoring TMPDIR then fails — seen live on mih34 as go's 'creating work dir: stat /tmp/user/120957: no such file or directory'. The JVM ignores TMPDIR, so Gradle builds never noticed. Explicit environment and bwrap.env entries can still override. (Werkdock's own engine is immune by design: it runs --clearenv.) Co-Authored-By: Claude Fable 5 --- .../kotlin/de/hoennig/werkator/build/BwrapBuildRunner.kt | 8 ++++++++ .../de/hoennig/werkator/build/BwrapBuildRunnerTest.kt | 6 ++++++ 2 files changed, 14 insertions(+) diff --git a/src/main/kotlin/de/hoennig/werkator/build/BwrapBuildRunner.kt b/src/main/kotlin/de/hoennig/werkator/build/BwrapBuildRunner.kt index f41cb69..63301f8 100644 --- a/src/main/kotlin/de/hoennig/werkator/build/BwrapBuildRunner.kt +++ b/src/main/kotlin/de/hoennig/werkator/build/BwrapBuildRunner.kt @@ -200,6 +200,14 @@ class BwrapBuildRunner( args += listOf("--ro-bind", "/etc/resolv.conf", "/etc/resolv.conf") args += listOf("--proc", "/proc", "--dev", "/dev", "--tmpfs", "/tmp") args += listOf("--setenv", "HOME", "/root") + // The sandbox /tmp is a fresh tmpfs, but bwrap inherits the server's + // environment — on hosts with pam_tmpdir that includes + // TMPDIR=/tmp/user/, which does not exist inside and breaks every + // tool honoring it (go: "creating work dir: stat ...: no such file or + // directory"; the JVM ignores TMPDIR, so Gradle never noticed). Set + // both back to /tmp; explicit env below can still override. + args += listOf("--setenv", "TMPDIR", "/tmp") + args += listOf("--setenv", "TMP", "/tmp") for ((key, value) in environment) { args += listOf("--setenv", key, value) } diff --git a/src/test/kotlin/de/hoennig/werkator/build/BwrapBuildRunnerTest.kt b/src/test/kotlin/de/hoennig/werkator/build/BwrapBuildRunnerTest.kt index 65c8932..3e8b988 100644 --- a/src/test/kotlin/de/hoennig/werkator/build/BwrapBuildRunnerTest.kt +++ b/src/test/kotlin/de/hoennig/werkator/build/BwrapBuildRunnerTest.kt @@ -104,6 +104,12 @@ class BwrapBuildRunnerTest : FunSpec() { "HOME", "/root", "--setenv", + "TMPDIR", + "/tmp", + "--setenv", + "TMP", + "/tmp", + "--setenv", "branch", "main", "--chdir",