- Landlock needs no separate executable, installation or `sysctl`
configuration, so use it as the only Linux sandbox implementation
rather than an opt-in behind `$HOMEBREW_SANDBOX_LINUX_LANDLOCK`.
- Delete `Sandbox::Bubblewrap`, the `brew setup-sandbox` command and
the implicit `bubblewrap` dependency, none of which Landlock needs.
- Remove the Bubblewrap-era `Sandbox` API (`ensure_sandbox_installed!`,
`configure!`, `configuration_commands`, `sandbox_install_command`)
and its call sites now that no backend needs installing or
configuring.
- Simplify `brew doctor`'s `check_linux_sandbox` to report the
Landlock failure reason with the `$HOMEBREW_NO_SANDBOX_LINUX`
workaround.
Since Ubuntu 24.04 uses GCC 14 libstdc++, we can build with GCC 14 when
a formula needs it. This avoids some less optimal conditional handling
of build dependencies which is needed when bottling.
The default should still be GCC 13 and will be picked by our
preferred_gcc. We should continue building with default to test more
common case of only installing unversioned gcc/g++ on Ubuntu. Once
enough formulae fail with GCC 13, we can move default to GCC 14.
- Use `bwrap` to translate shared sandbox rules into rootless
namespace execution.
- Gate the backend behind `HOMEBREW_SANDBOX_LINUX` while the Linux
policy is still experimental.
- Keep macOS on its existing `sandbox-exec` path while Linux uses shared
executable lookup for `bwrap`.
- Auto-install `bubblewrap` from `homebrew/core` when the sandbox is
enabled and no system or usable brewed binary is found.
- Prefer a usable system `bwrap` from `ORIGINAL_PATHS` over a brewed
one so distribution-provided binaries are used when available.
- Find brewed `bwrap` from `HOMEBREW_ORIGINAL_BREW_FILE` so integration
subprocesses still use the Linux sandbox.
- Preserve `Sandbox#run`'s tmpdir cwd inside the `bwrap` namespace and
suppress Linux PTY thread warnings after sandboxed children exit.
- Expose formula, Homebrew library and Linux runtime paths as read-only
binds so sandboxed source builds can run with vendored Ruby.
- Keep synthetic test formula installs off the API so sandbox CI does
not require network during local formula setup.
- Avoid creating optional prefix `var` directories just to configure a
test sandbox and remove empty Linux bind placeholders after runs.
- Require a working rootless `bwrap` on GitHub Actions and install the
system `bubblewrap` package before Linux tests run.
This matches what `brew shellenv` prints and make shell completions work
in containers (and codespaces). Evaluating `brew shellenv` does not work
because `brew shellenv` detects that `PATH` is already correctly set and
thus exits without printing anything.
I don't think `MANPATH` and `INFOPATH` (which are also printed by
`brew shellenv`) are needed in the Dockerfile because `man` and `info`
are not installed in the image.
- Separate cache tags because each architecture can replace a shared
registry cache and leave the other platform with little useful reuse.
- Pin `homebrew-core` as a build input so its layer can be reused
across brew-only changes without serving a stale tap after core moves.
- Keep generated Bundler cache files out of the Docker context so local
development artefacts do not bloat or invalidate image builds.
- Cache apt metadata and downloads because package installs are a
stable dependency layer and should not repeat avoidable network work.
ShellCheck sees Dockerfile as a regular shell script, so it cannot
understand it when the function definition `retry()` comes after the
`RUN` command (it sees it as a single command `RUN retry() ...`). As
this causes a parsing error, it cannot be worked around with a
`# shellcheck disable` comment. Instead, let's add a no-op `:` command
before the function definition, so that ShellCheck can happily parse the
file.
This seems to be broken on Ubuntu 22.04 at the moment. The system seems
to ship a reasonably modern version (2.34.1), so I think we can make do
with that for now.
In https://github.com/Homebrew/brew/pull/17584 we have changed "linuxbrew" user's UID/GID to 1001 in order to mitigate for Ubuntu 23.04 and higher, which started creating a default "ubuntu" user taking over UID/GID 1000 .
While we may desire a deterministic UID in the homebrew docker image, the change effectively modified the behaviour for all current 3 images based on Ubuntu 18.04 20.04 and 22.04 by changing the linuxbrew's user UID/GID from 1000 to 1001. As per https://hub.docker.com/u/homebrew, we do not currently publish an image for 24.04 which the change is mitigating for.
Rather than mitigating for indeterministic behaviour of upstream changes, this commit implements the workaround in https://bugs.launchpad.net/cloud-images/+bug/2005129 to delete the default "ubuntu" user.
apt installs an ancient `gh` that is missing some important flags. In
particular, we probably do want the `--match-head-commit` flag for the
extra security it gives us.
Mike McQuaid