mirror/nanobot
1
0
Fork 0
mirror of https://github.com/HKUDS/nanobot.git synced 2026-08-12 23:29:16 +03:00
Code Issues Packages Projects Releases Wiki Activity

test(docker): run bwrap check as final user

Browse Source 
Co-authored-by: yu-xin-c <175149126+yu-xin-c@users.noreply.github.com>
This commit is contained in:
Xubin Ren
2026-08-13 02:13:51 +09:00
co-authored by yu-xin-c
parent b571d3b9ff
commit b7f0ae95a9
1 changed files with 10 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/ci.yml
+9 -3
View File
@@ -214,11 +214,17 @@ jobs:
INNER INNER
OUTER OUTER
docker compose -f docker-compose.yml -f docker-compose.bwrap.yml \ docker compose -f docker-compose.yml -f docker-compose.bwrap.yml \
run --rm --no-deps -T --entrypoint sh nanobot-cli -s <<'BWRAP' run --rm --no-deps -T --user nanobot --entrypoint sh nanobot-cli -s <<'BWRAP'
set -eu set -eu
field() {
awk -v key="$1:" '$1 == key { print $2 }' /proc/self/status
}
test "$(id -u)" = "1000"
test "$(field NoNewPrivs)" = "1"
for capability_set in CapInh CapPrm CapEff CapAmb; do
test "$(field "$capability_set")" = "0000000000000000"
done
mkdir -p /home/nanobot/.nanobot/workspace mkdir -p /home/nanobot/.nanobot/workspace
chown -R nanobot:nanobot /home/nanobot/.nanobot
setpriv --reuid=nanobot --regid=nanobot --init-groups \
bwrap --new-session --die-with-parent \ bwrap --new-session --die-with-parent \
--ro-bind /usr /usr \ --ro-bind /usr /usr \
--ro-bind-try /bin /bin \ --ro-bind-try /bin /bin \