v1.0.0: Sandbox the compile execution path (extend unshare/bwrap beyond `suco run`)

[MicBur]

Roadmap: v1.0.0

src/worker/worker.cpp:42 (C3) already sandboxes the suco run arbitrary-command surface via unshare(1) (user+mount+pid namespaces, no-network, fails closed, opt-in SUCO_SANDBOX=1, startup self-check). This item extends isolation to the compile job path (g++ -c on remote workers) so a hostile/buggy TU can't touch the worker host on a shared LAN.

Scope

• Apply the namespace sandbox to the compiler invocation in the job executor (not just suco run)
• Keep fail-closed semantics and the startup capability self-check
• Measure per-TU overhead (must not regress the cold-build numbers meaningfully)
• Optional bubblewrap backend where available — note: blocked on apt install bubblewrap on the nodes (owner action); the unshare path needs no package and works today
• Docs: threat model + how to enable

Lane: Linux/grid (Claude).

[MicBur]

Empirically de-risked (2026-07-27, node3 Ubuntu 26.04). Compiling a TU under a sandbox produces a byte-identical object to native (namespaces don't perturb compiler output), verified for both backends:

• unshare --user --map-root-user --mount --pid --fork --net (ro fs + rw workdir) → rc 0, byte-identical.
• bwrap --ro-bind / / --bind <workdir> --unshare-net → rc 0, byte-identical.

bwrap is installed on node3 and unprivileged userns works (kernel.apparmor_restrict_unprivileged_userns=0) — so this is no longer blocked on apt install bubblewrap (at least on that node).

Implementation note for the worker wiring: the object is written to a /tmp temp path outside the job dir, so the sandbox must bind that path (or move the output into the job dir) writable — bwrap --ro-bind / / alone leaves /tmp read-only. Prefer bwrap when present; fall back to unshare (already used by suco run, worker.cpp:build_run_command). Reuse SUCO_SANDBOX gate; keep fail-closed.

[MicBur]

Compile-path sandbox landed (#55). Opt-in SUCO_SANDBOX=1 now wraps the worker's compiler invocation in a read-only-fs + rw-job-dir + no-net sandbox (bwrap preferred, unshare fallback). Verified on node3: SUCO_SANDBOX=1 ci_smoke_test.sh → 7 TUs compiled sandboxed, valid objects, binary links+runs, 7/7 cache hits, no crashes; byte-identical to native. Default behaviour unchanged (no-op when off). Remaining for full close: per-job /tmp isolation (currently binds all of /tmp rw), and a startup capability note. The suco run surface was already sandboxed.

[MicBur]

Per-job /tmp isolation landed (#103) — this was the last item for #43.

The sandbox previously had to expose all of /tmp read-write, because the object lived beside the job dir and the compiler wrote its intermediates (cc*.s) there — so concurrent jobs on one worker could see and clobber each other's scratch. Now the object is at <job_dir>/suco_out.o and TMPDIR points at the job dir, so the sandbox binds only that one directory.

Verified on node3 with the exact command the code generates: compile succeeds with only job_dir writable, the object is byte-identical to an unsandboxed reference (138 640 B), and the negative control (touch /tmp/...) correctly fails with "Read-only file system". Moving the object is byte-safe — the -o path is not embedded in the output (checked for -O2 and -g). All CI green.

#43 is now complete: suco run sandboxed (C3), compile path sandboxed (#55), per-job isolation (#103).