Repository navigation
feat(rust-ci): add bubblewrap 0.13.1 for TinyBox jails - #33
Conversation
Introduces a Docker image for Rust continuous integration and a smoke test script that verifies the toolchain works inside the built image. Auto-committed-on: macbook Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Tiny Sweeper reviewTiny Sweeper reviewed this change across 5 lane(s) and found 0 active actionable finding(s). Detailed lane evidence and any incomplete work are listed below. State: Incomplete Review snapshot
Completeness: Incomplete FeaturesNone identified with supported citations. TestsNo supported feature-to-test mapping was produced. Test execution is not inferred.
FindingsNo active actionable findings. Could not review: images/rust-ci/Dockerfile, images/rust-ci/README.md, images/rust-ci/smoke.sh, tinysweeper/description, tinysweeper/tests Before merge
Agent review detailscritique
security
tests
commits
description
Evidence and run details
|
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
![tinysweeper[bot]](https://avatars.githubusercontent.com/in/4526585?s=60&v=4){kind=small}
There was a problem hiding this comment.
tinysweeper found nothing blocking, but could not review everything, so this is not an approval: images/rust-ci/Dockerfile, images/rust-ci/README.md, images/rust-ci/smoke.sh, tinysweeper/description, tinysweeper/tests.
$0.0000 · 0 in / 0 out · 320 embedded · ladder/vectors-oai3
tinysweeper
Bot
added
the
priority: p3
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Description Check |  |
Check skipped - CodeRabbit’s high-level summary is enabled. |
| Title check | |
The title clearly and concisely describes the main change: adding Bubblewrap 0.13.1 to the Rust CI image for TinyBox jails. |
| Docstring Coverage | |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. (2 skipped: 2 unsupported.)
✨ Finishing Touches
-
📝 Generate docstrings
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
A rabbit checks the bwrap build,
The checksum matches, neat and skilled.
Root owns the tool, its mode is right,
Namespaces make the jail take flight.
The smoke checks pass; I hop away,
With carrots saved for build-break day.
Comment @coderabbitai help to get the list of available commands.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Why
OpenHuman's registry-path MCP tests are
ignored on Linux in EX63 (e.g.tests/raw_coverage/tool_registry_approval_raw_coverage_e2e.rs:410) because TinyBox needs bubblewrap >= 0.8 (--disable-userns). This image is Ubuntu 22.04, which ships bubblewrap 0.6.1, so TinyBox reports isolationNoneand refuses untrusted servers.What
bwrap-buildstage builds bubblewrap 0.13.1 (meson/ninja, libcap-dev) from the upstream release tarball, pinned and verified against sha2560e85c870...17c4d(matches the release page)./usr/bin/bwrap: root:root, 0755, not setuid.libcap2added to the runtime apt list.smoke.sh(runs at image build) checks/usr/bin/bwrapownership/mode, version >= 0.8.0, and--disable-usernsin--help.bwrap0.6.1 is not installed either way;/usr/bin/bwrapis now the new build).Verified locally (linux/amd64)
bwrap stage builds; version 0.13.1;
root:root 755;--disable-usernspresent. As a non-root user underdocker run --privileged:bwrap --unshare-all --unshare-user --disable-userns --die-with-parent --ro-bind / / trueexits 0, and nested user-ns creation inside is refused (ENOSPC). Note--disable-usernsrequires--unshare-userexplicitly. The full image was not built locally; CI does that.Not covered
The jail also needs the EX63 microVM guest kernel to allow unprivileged user namespaces; that is separate from this image (see the follow-up in gh-hosted-runner). After merge, the new digest must be bumped in OpenHuman's
scripts/ci/self-hosted/guest-image.txt.Summary by CodeRabbit