fix(sandbox): proxy pass-through + bwrap compat on CentOS 7 / kernel 3.10 - #811
Merged
Merged
Conversation
…3.10 - Add http_proxy/https_proxy/no_proxy fields to SandboxConfig and from_dict() - Pass proxy env vars from global settings (HTTP_PROXY/HTTPS_PROXY/NO_PROXY and per-sandbox SANDBOX_HTTP_PROXY/SANDBOX_HTTPS_PROXY/SANDBOX_NO_PROXY) into get_sandbox_config() with the sandbox-specific setting taking precedence - Inject proxy variables into subprocess env (_build_safe_env) and into bwrap sandbox via --setenv flags (_build_bwrap_command) - Propagate proxy env into DockerBackend container environment Fix bwrap incompatibility with CentOS 7 / Linux 3.10 kernels: - Replace --unshare-cgroup (requires Linux ≥ 4.6) with --unshare-cgroup-try (gracefully skips if kernel does not support cgroup namespace) - Remove --unshare-user which is blocked when user.max_user_namespaces=0 or sysctl namespace.unpriv_enable=1 is not set - Add SetUID bit on /usr/bin/bwrap in Dockerfile so it can operate in privileged mode when user namespaces are unavailable Add unit tests covering proxy propagation in safe env, bwrap command, and SandboxConfig.from_dict
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
问题
在 CentOS 7（Linux 内核 3.10）环境下运行 bubblewrap 沙箱时报错：
根本原因有三：
--unshare-cgroup要求 Linux ≥ 4.6，旧内核不支持 cgroup namespace。--unshare-user在user.max_user_namespaces=0或未设置namespace.unpriv_enable=1时无法创建 user namespace。此外，subprocess 子进程缺乏 http_proxy / https_proxy 代理环境变量透传机制。
修改内容
bwrap 旧内核兼容性
--unshare-cgroup替换为--unshare-cgroup-try（内核不支持时优雅跳过）--unshare-user（在无 unprivileged namespace 支持的系统上阻塞启动）backend/Dockerfile中为/usr/bin/bwrap增加 SetUID 位，支持无 user namespace 的宿主机环境代理透传
SandboxConfig新增http_proxy、https_proxy、no_proxy字段，from_dict()同步支持 fallback 解析Settings新增HTTPS_PROXY、NO_PROXY、SANDBOX_HTTP_PROXY、SANDBOX_HTTPS_PROXY、SANDBOX_NO_PROXY配置项get_sandbox_config()优先使用SANDBOX_*环境变量，回退到全局HTTP_PROXY/HTTPS_PROXY/NO_PROXYSubprocessBackend._build_safe_env()将代理变量注入子进程环境（同时写大小写两个变体）SubprocessBackend._build_bwrap_command()通过--setenv将代理变量透传进 bubblewrap 沙箱内部DockerBackend容器 env 同步注入代理变量测试
新增单元测试覆盖：
_build_safe_env中代理变量注入_build_bwrap_command中 bwrap flag 和代理--setenv验证（含断言--unshare-cgroup-try在、--unshare-user/--unshare-cgroup不在）SandboxConfig.from_dict代理字段解析所有测试通过（5/5），Ruff 检查干净。