Problem statement
Doing an experiment with buck2, I found collisions happening in actions in /tmp when pid-based predictable dirs were made in /tmp. Yes thats an antipattern, but the instance wasn't of my making.
Setting an entrypoint script like:
#!/bin/sh
mount -t tmpfs tmpfs /tmp 2>/dev/null || true
exec "$@"
worked but it seems to me this is something nativelink could do itself, perhaps always, or perhaps just when use_namespaces is on.
Config:
local: {
worker_api_endpoint: { uri: "grpc://127.0.0.1:50061" },
cas_fast_slow_store: "WORKER_FAST_SLOW_STORE",
upload_action_result: { ac_store: "AC_MAIN_STORE" },
work_directory: "${HOME}/nativelink/work",
entrypoint: "/home/nativelink/nl-entrypoint.sh",
use_namespaces: true,
use_mount_namespace: true,
platform_properties: {
cpu_count: { query_cmd: "nproc" },
OSFamily: { query_cmd: "uname -s" },
},
Proposed solution
Mount a clean tmpfs per action.
Alternatives considered
Get everyone world wide to write secure container-safe-code :P.
Additional context
No response
Problem statement
Doing an experiment with buck2, I found collisions happening in actions in /tmp when pid-based predictable dirs were made in /tmp. Yes thats an antipattern, but the instance wasn't of my making.
Setting an entrypoint script like:
worked but it seems to me this is something nativelink could do itself, perhaps always, or perhaps just when use_namespaces is on.
Config:
Proposed solution
Mount a clean tmpfs per action.
Alternatives considered
Get everyone world wide to write secure container-safe-code :P.
Additional context
No response