executor: expose file descriptors inside action sandboxes - #37
Open
zbarsky-openai wants to merge 1 commit into
Open
zbarsky-openai wants to merge 1 commit into
zbarsky-openai wants to merge 1 commit into
Conversation
Bash process substitutions fail inside action sandboxes because the normal `/dev/fd` descriptor link is absent: ```text join: /dev/fd/63: No such file or directory sort: cannot read: /dev/fd/62: No such file or directory ``` This occurs in real remote `UnusedTarInputs` actions while computing OCI-layer dependencies. Some actions continue after the error, leaving incorrect or empty unused-input sets. Create the standard `/dev/fd -> /proc/self/fd` symlink in each action's existing device directory. The action already mounts its own procfs after entering its mount namespace, so the link remains local to the sandbox and requires no runtime packages or additional mounts. Extend the existing base directory test to assert the exact symlink target. The failure was reproduced in all four remote OCI-layer rule tests with Bazel `9.3.0-actiond-dzbarsky14` and actiond invocation `e04aa24e-0f40-4715-92b9-1afe76b48268`. Running the upstream unit suite locally is currently blocked by the repository's rejected BuildBuddy API key.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bash process substitutions fail inside action sandboxes because the normal
/dev/fddescriptor link is absent:This occurs in real remote
UnusedTarInputsactions while computing OCI-layerdependencies. Some actions continue after the error, leaving incorrect or empty
unused-input sets.
Create the standard
/dev/fd -> /proc/self/fdsymlink in each action'sexisting device directory. The action already mounts its own procfs after
entering its mount namespace, so the link remains local to the sandbox and
requires no runtime packages or additional mounts. Extend the existing base
directory test to assert the exact symlink target.
The failure was reproduced in all four remote OCI-layer rule tests with Bazel
9.3.0-actiond-dzbarsky14and actiond invocatione04aa24e-0f40-4715-92b9-1afe76b48268. Running the upstream unit suitelocally is currently blocked by the repository's rejected BuildBuddy API key.