Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Run respec without sandbox #4358

Merged
merged 1 commit into from
Feb 20, 2025
Merged

Run respec without sandbox #4358

merged 1 commit into from
Feb 20, 2025

Conversation

ralfhandl
Copy link
Contributor

@ralfhandl ralfhandl commented Feb 13, 2025

Alternative to

Respec depends on puppeteer which does not support running in a sandbox with the latest Ubuntu. Official recommendation:

What if I don‘t have root access to the machine and can’t install anything?

You will need to run developer builds with the --no-sandbox command line flag, but be aware that this disables critical security features of Chromium and should never be used when browsing the open web.

I don't want to mess with the GitHub Ubuntu image, we are not browsing the open web, and we only tell puppeteer to access local HTML files that we generated ourselves, so this should be safe enough.

Tick one of the following options:

  • schema changes are included in this pull request
  • schema changes are needed for this pull request but not done yet
  • no schema changes are needed for this pull request

to circumvent puppeteer problem on Ubuntu > 22
@ralfhandl ralfhandl requested review from a team as code owners February 13, 2025 22:17
@ralfhandl ralfhandl mentioned this pull request Feb 13, 2025
3 tasks
@ralfhandl ralfhandl added the script Pull requests that update Bash or JavaScript code label Feb 13, 2025
@duncanbeevers
Copy link
Contributor

duncanbeevers commented Feb 17, 2025

I don't know how far down the rabbit hole it's worth going on this, but I don't think it's unreasonable to set up an AppArmor profile for puppeteer.

There's an aa-genprof tool we can use during a build to determine what permissions are necessary and to automatically generate a minimal AppArmor profile, which we can then commit and enforce.

If a profile does not exist for the program, aa-genprof will create one using aa-autodep
Genprof will then:
- set the profile to complain mode
- write a mark to the system log
- instruct the user to start the application to be profiled in another window and exercise its functionality
It then presents the user with two options, (S)can system log for entries to add to profile and (F)inish.

@ralfhandl
Copy link
Contributor Author

ralfhandl commented Feb 18, 2025

I do not want to go anywhere near that rabbit hole.

There are two easy ways to get our spec build process running again:

Or we can leave the build process broken until the involved tools start working together again in a future version.

Side note: Arazzo and Overlays went back to the last working Ubuntu image provided by GitHub.

Copy link
Contributor

@lornajane lornajane left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this is a good solution for the time being. Thank you!

@lornajane lornajane merged commit 4f0379b into main Feb 20, 2025
6 checks passed
@lornajane lornajane deleted the ralfhandl-respec-no-sandbox branch February 20, 2025 16:00
@ralfhandl ralfhandl mentioned this pull request Feb 26, 2025
3 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
script Pull requests that update Bash or JavaScript code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants