Sandbox - The build sandbox¶
Element plugins which want to interface with the sandbox
need only understand this interface, while it may be given a different
sandbox implementation, any sandbox implementation it is given will
conform to this interface.
See also: Sandboxing.
Flags indicating how the sandbox should be run.
The root filesystem is read only.
This is normally true except when running integration commands on staged dependencies, where we have to update caches and run things such as ldconfig.
Whether to expose host network.
This should not be set when running builds, but can be allowed for running a shell in a sandbox.
Whether to run the sandbox interactively
This determines if the sandbox should attempt to connect the terminal through to the calling process, or detach the terminal entirely.
Whether to use the user id and group id from the host environment
This determines if processes in the sandbox should run with the same user id and group id as BuildStream itself. By default, processes run with user id and group id 0, protected by a user namespace where available.
Sandbox programming interface for
DEVICES= ['/dev/urandom', '/dev/random', '/dev/zero', '/dev/null']¶
Fetches the sandbox root directory
The root directory is where artifacts for the base runtime environment should be staged.
Returns: The sandbox root directory Return type: (str)
Sets the environment variables for the sandbox
Parameters: directory (dict) – The environment variables to use in the sandbox
Sets the work directory for commands run in the sandbox
Parameters: directory (str) – An absolute path within the sandbox
mark_directory(directory, *, artifact=False)¶
Marks a sandbox directory and ensures it will exist
- directory (str) – An absolute path within the sandbox to mark
- artifact (bool) – Whether the content staged at this location contains artifacts
Any marked directories will be read-write in the sandboxed environment, only the root directory is allowed to be readonly.
run(command, flags, *, cwd=None, env=None)¶
Run a command in the sandbox.
- command (list) – The command to run in the sandboxed environment, as a list of strings starting with the binary to run.
- flags (
SandboxFlags) – The flags for running this command.
- cwd (str) – The sandbox relative working directory in which to run the command.
- env (dict) – A dictionary of string key, value pairs to set as environment variables inside the sandbox environment.
The program exit code.
ProgramNotFoundError) – If a host tool which the given sandbox implementation requires is not found.
The optional cwd argument will default to the value set with