Need to support networking sandbox about bazel-buildfarm HOT 5 CLOSED

@joshenders , I need this for when the tests/actions run, not as part of the worker configuration.

from bazel-buildfarm.

It looks like NettyServerBuilder supports forAddress(). Would it be safe to just drop this in as a replacement for ServerBuilder here along with the needed code for deriving addresses from a list in the configuration file?

from bazel-buildfarm.

I can make this available as a feature on the workers as a tristate, with disabled, contingent on a platform request for it by name, and enabled for all.

I have added jnr-ffi as a dependency for other reasons, it should be either easily implemented or imported to control the private network namespace of a fork.

from bazel-buildfarm.

This will be made available through the default (or configured) policy specification on #188 - you can specify an execution wrapper policy that points to a binary which can modify the network namespace before executing a process. Take care to ensure that you don't introduce orphaned/dangling process children or leave stdout/stderr open - I have seen operations get stuck in this case, and sufficient process control needs to be implemented to kill any init-reparented processes that are not the worker.

from bazel-buildfarm.

#188 has landed. Closing this out, as any binary can be used to wrap execution and control the network namespace of the process. Note my cautions above, and feel free to reopen if you see any issues!

from bazel-buildfarm.