rivox 1.0.0

Universal polyglot build coordination layer for Python, Rust, and Node monorepos
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68

use super::SandboxExecutor;
use anyhow::{Context, Result};
use std::path::Path;
use std::process::{Command, Output};

pub struct LinuxSandbox;

impl SandboxExecutor for LinuxSandbox {
    fn name(&self) -> &'static str {
        "linux-namespaces-bwrap"
    }

    fn execute(
        &self,
        command: &str,
        args: &[&str],
        work_dir: &Path,
        allow_network: bool,
    ) -> Result<Output> {
        let bwrap_path = Path::new("/usr/bin/bwrap");

        if bwrap_path.exists() {
            let mut bwrap_cmd = Command::new(bwrap_path);
            bwrap_cmd
                .arg("--ro-bind")
                .arg("/")
                .arg("/")
                .arg("--dev")
                .arg("/dev")
                .arg("--proc")
                .arg("/proc")
                .arg("--bind")
                .arg(work_dir)
                .arg(work_dir)
                .current_dir(work_dir);

            if !allow_network {
                bwrap_cmd.arg("--unshare-net");
            }

            bwrap_cmd.arg(command).args(args);

            let output = bwrap_cmd
                .output()
                .with_context(|| format!("Linux bubblewrap sandbox failed for {}", command))?;

            return Ok(output);
        }

        // Fallback execution when bwrap binary is absent
        let mut cmd = Command::new(command);
        cmd.args(args).current_dir(work_dir);

        if !allow_network {
            cmd.env("RIVOX_SANDBOX_NETWORK", "0");
        }

        let output = cmd.output().with_context(|| {
            format!(
                "Linux sandbox fallback failed executing {} in {}",
                command,
                work_dir.display()
            )
        })?;

        Ok(output)
    }
}