bwrap previously built its own specs.Spec, wrote an OCI bundle and drove
runsc/container directly. It now only parses the bubblewrap command line
and translates it into sandbox.Options; //sandboxexec/sandbox owns the
bundle, the runsc invocation and the container lifecycle.
This change refactors how network isolation is configured in both the Go and
Python sandbox APIs. Instead of a boolean enable/disable flag, a new
NetworkMode enum (supporting "none", "host", and "sandbox") is introduced.
PiperOrigin-RevId: 967507724
Add support for custom directory mounts (bind mounts, in-memory tmpfs mounts,
and procfs mounts) to the Python SandboxExec bindings (gvisor.sandbox).
Features introduced:
- Mount dataclass with factory methods:
Mount.bind(source, destination, readonly=False),
Mount.tmpfs(destination), and Mount.proc(destination).
- MountType enum supporting 'bind', 'tmpfs', and 'proc'.
- _normalize_mounts private module-level helper function to validate and
normalize mount configurations from Mount instances or dictionary
definitions.
- mounts parameter in Sandbox.__init__ to configure container mounts in OCI
config.json spec.
- Exported Mount and MountType in gvisor package root.
- Comprehensive unit and integration tests covering read-only bind mounts,
read-write bind mounts, tmpfs, proc mounts, dictionary configuration,
validation error cases, and Mount factory methods.
PiperOrigin-RevId: 964427990
Add support for configuring the container working directory and per-command
working directory overrides in the Python SandboxExec bindings (gvisor.sandbox).
Features introduced:
- Added working_dir parameter to Sandbox.__init__ to configure the initial
working directory inside the container (written to spec.process.cwd in
config.json). Defaults to "/".
- Added _normalize_working_dir private module-level helper to normalize and
validate working directory paths into absolute POSIX paths.
- Added cwd parameter to Sandbox.exec to support per-command execution directory
overrides via the '--cwd' flag passed to runsc exec.
- Added comprehensive unit test coverage for default/unset working_dir, custom
paths, relative path normalization, invalid values, and exec cwd overrides.
PiperOrigin-RevId: 963705877
The change doens't have actual implementation. It demonstrates
the API design on how runsc go binding does checkpoint and restore.
The API aims to unify all 3 existing gVisor snapshot/checkpoint
methods.
PiperOrigin-RevId: 948000243
- Add UserNamespace, single-UID mapping, and remove NetworkNamespace when
non-root.
- Append --ignore-cgroups and --network=none when non-root.
It limites how we use the networking, if the networking is needed, it will
need sudo, alternatively, users can specify host network with rootless.
PiperOrigin-RevId: 926214126
On most modern arm64 (AArch64) Linux distributions, the /lib64 directory
does not exist because the system libraries are purely 64-bit and reside
directly in /lib.
PiperOrigin-RevId: 907969863
Jing Chen