Repository navigation
ci: let bubblewrap create a user namespace on the runner - #84
Merged
Merged
Conversation
The judge-image job failed its first run against a master that has the sandbox: 820 tests, 48 of them skipped with "bubblewrap cannot create a sandbox here (user namespaces unavailable?)", and --fail-on-skipped turned that into a failure. Which is the job working as intended -- that flag exists precisely so a sandbox that cannot start reads as a failure rather than as a green build over 48 quietly skipped tests. The cause is the host, not the container: Ubuntu 24.04 runners set kernel.apparmor_restrict_unprivileged_userns=1, and AppArmor is enforced on the host, so --privileged alone does not get bwrap a user namespace. The sysctl is relaxed before the run, and apparmor/seccomp confinement is dropped explicitly rather than relied on as a side effect of --privileged. Both sysctls are `|| true`: neither knob exists on every runner image, and their absence is not itself a problem. Whether the sandbox actually came up is decided by --fail-on-skipped, not by these lines succeeding. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Pvf2R8xtgbWQm1wRvjBqQY
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
O job
judge-imagefalhou na primeira execução contra um master que já tem o sandbox: 820 testes, 48 pulados combubblewrap cannot create a sandbox here (user namespaces unavailable?), e o--fail-on-skippedtransformou isso em falha.Que é o job funcionando como projetado — a flag existe exatamente para que um sandbox que não sobe apareça como falha, e não como build verde por cima de 48 testes silenciosamente pulados.
A causa é o host, não o container: runners Ubuntu 24.04 vêm com
kernel.apparmor_restrict_unprivileged_userns=1, e AppArmor é aplicado no host — então--privilegedsozinho não dá user namespace ao bwrap. O sysctl é relaxado antes da execução, e o confinamento apparmor/seccomp é removido explicitamente em vez de contar com ele como efeito colateral do--privileged.Os dois sysctls levam
|| true: nenhum dos dois existe em toda imagem de runner, e a ausência deles não é problema por si. Quem decide se o sandbox realmente subiu é o--fail-on-skipped, não o sucesso dessas linhas.🤖 Generated with Claude Code
https://claude.ai/code/session_01Pvf2R8xtgbWQm1wRvjBqQY