Make the bwrap alias a wrapper around the sandboxexec Go bindings. - #14022
Open
milantracy wants to merge 1 commit into
Open
Make the bwrap alias a wrapper around the sandboxexec Go bindings.#14022milantracy wants to merge 1 commit into
milantracy wants to merge 1 commit into
Conversation
rexren-gif
approved these changes
Aug 6, 2026
EtiennePerot
requested changes
Aug 6, 2026
copybara-service Bot
pushed a commit
that referenced
this pull request
Aug 6, 2026
bwrap previously built its own specs.Spec, wrote an OCI bundle and drove runsc/container directly. It now only parses the bubblewrap command line and translates it into sandbox.Options; //sandboxexec/sandbox owns the bundle, the runsc invocation and the container lifecycle. To support this, the bindings gain: - Run, an attached counterpart to New that runs a command to completion over `runsc run`, preserving its stdio and exit code, and relaying signals into the container via `runsc kill`. - Options for the process, rootfs, namespaces, ID mappings and mount options bwrap needs, plus opt-outs for the bindings' default mounts, host binary mounts and base environment. Every zero value reproduces the previous bundle layout. - Config, which resolves options into a BundleConfig for testing. - runsc stderr in the failure message from New, instead of a bare exit status. Signal relaying skips SIGURG, SIGPIPE and SIGCHLD as pkg/sighandling does; relaying SIGCHLD would be self-sustaining, since each forwarded signal spawns a runsc process whose exit raises another. Behavior deltas: bwrap now forks a runsc process, passes --ignore-cgroups when not root, and roots a container with no `--bind / /` at the bundle's rootfs directory rather than a separate temporary directory. FUTURE_COPYBARA_INTEGRATE_REVIEW=#14022 from milantracy:bwrap 24a225e PiperOrigin-RevId: 960524302
6 tasks
copybara-service Bot
pushed a commit
that referenced
this pull request
Aug 6, 2026
bwrap previously built its own specs.Spec, wrote an OCI bundle and drove runsc/container directly. It now only parses the bubblewrap command line and translates it into sandbox.Options; //sandboxexec/sandbox owns the bundle, the runsc invocation and the container lifecycle. To support this, the bindings gain: - Run, an attached counterpart to New that runs a command to completion over `runsc run`, preserving its stdio and exit code, and relaying signals into the container via `runsc kill`. - Options for the process, rootfs, namespaces, ID mappings and mount options bwrap needs, plus opt-outs for the bindings' default mounts, host binary mounts and base environment. Every zero value reproduces the previous bundle layout. - Config, which resolves options into a BundleConfig for testing. - runsc stderr in the failure message from New, instead of a bare exit status. Signal relaying skips SIGURG, SIGPIPE and SIGCHLD as pkg/sighandling does; relaying SIGCHLD would be self-sustaining, since each forwarded signal spawns a runsc process whose exit raises another. Behavior deltas: bwrap now forks a runsc process, passes --ignore-cgroups when not root, and roots a container with no `--bind / /` at the bundle's rootfs directory rather than a separate temporary directory. FUTURE_COPYBARA_INTEGRATE_REVIEW=#14022 from milantracy:bwrap 24a225e PiperOrigin-RevId: 960524302
copybara-service Bot
pushed a commit
that referenced
this pull request
Aug 6, 2026
bwrap previously built its own specs.Spec, wrote an OCI bundle and drove runsc/container directly. It now only parses the bubblewrap command line and translates it into sandbox.Options; //sandboxexec/sandbox owns the bundle, the runsc invocation and the container lifecycle. To support this, the bindings gain: - Run, an attached counterpart to New that runs a command to completion over `runsc run`, preserving its stdio and exit code, and relaying signals into the container via `runsc kill`. - Options for the process, rootfs, namespaces, ID mappings and mount options bwrap needs, plus opt-outs for the bindings' default mounts, host binary mounts and base environment. Every zero value reproduces the previous bundle layout. - Config, which resolves options into a BundleConfig for testing. - runsc stderr in the failure message from New, instead of a bare exit status. Signal relaying skips SIGURG, SIGPIPE and SIGCHLD as pkg/sighandling does; relaying SIGCHLD would be self-sustaining, since each forwarded signal spawns a runsc process whose exit raises another. Behavior deltas: bwrap now forks a runsc process, passes --ignore-cgroups when not root, and roots a container with no `--bind / /` at the bundle's rootfs directory rather than a separate temporary directory. FUTURE_COPYBARA_INTEGRATE_REVIEW=#14022 from milantracy:bwrap 24a225e PiperOrigin-RevId: 960524302
parth-opensrc
approved these changes
Aug 12, 2026
EtiennePerot
left a comment
EtiennePerot
left a comment
Collaborator
There was a problem hiding this comment.
Please write the comments as a human, this is annoying to read :)
milantracy
force-pushed
the
bwrap
branch
2 times, most recently
from
August 22, 2026 01:06
b3ad814 to
383e41e
Compare
EtiennePerot
requested changes
Aug 22, 2026
milantracy
force-pushed
the
bwrap
branch
2 times, most recently
from
August 25, 2026 08:43
b3bc79e to
2fc124d
Compare
EtiennePerot
requested changes
Aug 25, 2026
milantracy
requested review from
carzh,
fvoznika and
manninglucas
as code owners
August 27, 2026 08:33
bwrap previously built its own specs.Spec, wrote an OCI bundle and drove runsc/container directly. It now only parses the bubblewrap command line and translates it into sandbox.Options; //sandboxexec/sandbox owns the bundle, the runsc invocation and the container lifecycle.
EtiennePerot
approved these changes
Aug 28, 2026
EtiennePerot
left a comment
EtiennePerot
left a comment
Collaborator
There was a problem hiding this comment.
Looks good other than the one comment
| // The command inherits the working directory, environment, user and | ||
| // capabilities the sandbox was created with. Calls may run concurrently, unless | ||
| // WithExecSignalRelay asks for the signal relay. | ||
| func (s *Sandbox) Exec(ctx context.Context, opts ...ExecOption) (*ExecResult, error) { |
Collaborator
There was a problem hiding this comment.
Sorry, I should probably have brought this up before, but I think we should keep arguments in the function signature rather than requiring WithExecArgs. This is similar to how all other exec-ish APIs work (positional arguments used to encode argv, optional/keyword-ish arguments to encode options)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
bwrap previously built its own specs.Spec, wrote an OCI bundle and drove runsc/container directly. It now only parses the bubblewrap command line and translates it into sandbox.Options; //sandboxexec/sandbox owns the bundle, the runsc invocation and the container lifecycle.
Update #13747
Fix #14020