From e66f44ff9a76f4514fc2e5a8ab76061a7bebe7eb Mon Sep 17 00:00:00 2001 From: Roland Schlaefli Date: Mon, 29 Jun 2026 20:50:21 +0200 Subject: [PATCH] fix(sandbox): allow spec-guard reads in rootfs --- .github/workflows/ci.yml | 1 + api/Dockerfile | 3 ++- docker/Dockerfile.worker-sandbox | 3 ++- launcher/Dockerfile | 3 ++- 4 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d73538a..0f2e5c7 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -57,6 +57,7 @@ jobs: working-directory: api/src run: | gcc -O2 -static -Wall -Wextra -Werror -o /tmp/spec-guard spec-guard.c + chmod 0555 /tmp/spec-guard # Smoke: spec-guard must execvp its argument cleanly. Use a # parent process with a known FD population so we also assert # the close-inherited-FDs path runs (child must see only the diff --git a/api/Dockerfile b/api/Dockerfile index ff4e848..04599e3 100644 --- a/api/Dockerfile +++ b/api/Dockerfile @@ -29,8 +29,9 @@ RUN git clone -b master --single-branch https://github.com/google/nsjail.git . \ RUN make -j$(nproc) COPY api/src/spec-guard.c /tmp/spec-guard.c +# KVM/nsjail execution may need read permission on virtiofs-backed rootfs. RUN gcc -O2 -static -o /usr/local/bin/spec-guard /tmp/spec-guard.c \ - && chmod 0111 /usr/local/bin/spec-guard + && chmod 0555 /usr/local/bin/spec-guard # ============================================================================ # Stage 1b: Build language runtime packages (only consumed by sandbox-runner-baked) diff --git a/docker/Dockerfile.worker-sandbox b/docker/Dockerfile.worker-sandbox index 5e0c97d..db95fd5 100644 --- a/docker/Dockerfile.worker-sandbox +++ b/docker/Dockerfile.worker-sandbox @@ -42,8 +42,9 @@ RUN git clone -b master --single-branch https://github.com/google/nsjail.git . \ RUN make -j$(nproc) COPY api/src/spec-guard.c /tmp/spec-guard.c +# KVM/nsjail execution may need read permission on virtiofs-backed rootfs. RUN gcc -O2 -static -o /usr/local/bin/spec-guard /tmp/spec-guard.c \ - && chmod 0111 /usr/local/bin/spec-guard + && chmod 0555 /usr/local/bin/spec-guard # ============================================================================ # Stage 2: Build worker diff --git a/launcher/Dockerfile b/launcher/Dockerfile index 0d252c2..c04b98c 100644 --- a/launcher/Dockerfile +++ b/launcher/Dockerfile @@ -33,8 +33,9 @@ RUN git clone -b master --single-branch https://github.com/google/nsjail.git . \ RUN make -j$(nproc) COPY api/src/spec-guard.c /tmp/spec-guard.c +# KVM/nsjail execution may need read permission on virtiofs-backed rootfs. RUN gcc -O2 -static -o /usr/local/bin/spec-guard /tmp/spec-guard.c \ - && chmod 0111 /usr/local/bin/spec-guard + && chmod 0555 /usr/local/bin/spec-guard FROM oven/bun:1.3.14-debian AS sandbox-build