Enable hermetic Bazel sandboxing #902
Conversation
The `--incompatible_sandbox_hermetic_tmp` flag doesn't work when `TMPDIR` or `TMP` are set to a location under `/tmp`. Nix shells set these environment variables to `/tmp/nix-shell.xxxxxx`, triggering mount errors. This change enables the flag by wrapping Bazel in the Nix shell with a script that unsets the `TMP` and `TMPDIR` environment variables.
There was a problem hiding this comment.
Reviewable status: 0 of 1 LGTMs obtained, and pending CI: Analyze (javascript-typescript), Analyze (python), Bazel Dev / ubuntu-22.04, Cargo Dev / macos-13, Cargo Dev / ubuntu-22.04, Local / ubuntu-22.04, Publish image, Publish nativelink-worker-lre-cc, Remote / large-ubuntu-22.04, asan / ubuntu-22.04, docker-compose-compiles-nativelink (20.04), docker-compose-compiles-nativelink (22.04), integration-tests (20.04), integration-tests (22.04), macos-13, pre-commit-checks, ubuntu-20.04 / stable, ubuntu-22.04, ubuntu-22.04 / stable, vale, windows-2022 / stable (waiting on @adam-singer)
There was a problem hiding this comment.
Reviewed 2 of 2 files at r1, all commit messages.
Reviewable status:complete! 1 of 1 LGTMs obtained
The
--incompatible_sandbox_hermetic_tmpflag doesn't work whenTMPDIRorTMPare set to a location under/tmp. Nix shells set these environment variables to/tmp/nix-shell.xxxxxx, triggering mount errors. This change enables the flag by wrapping Bazel in the Nix shell with a script that unsets theTMPandTMPDIRenvironment variables.This change is