From 7e0a3d1d933fe225cd994f5ff432bd58f5541378 Mon Sep 17 00:00:00 2001 From: ymq Date: Fri, 14 Aug 2026 11:15:03 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20=E8=BF=9C=E7=A8=8B=E6=B2=99=E7=AE=B1=20b?= =?UTF-8?q?wrap=20=E8=B7=AF=E5=BE=84=E6=8E=A2=E6=B5=8B=EF=BC=88PATH=20?= =?UTF-8?q?=E4=BC=98=E5=85=88=E5=9B=9E=E9=80=80=20~/bin/bwrap=EF=BC=89?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- pipeline_service/work_env.py | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/pipeline_service/work_env.py b/pipeline_service/work_env.py index 7298ba7..0047114 100644 --- a/pipeline_service/work_env.py +++ b/pipeline_service/work_env.py @@ -213,11 +213,8 @@ def _row_to_env_from_dict(data: dict) -> dict: # ═══════════════════════════════════════════════════════════ def _remote_bwrap_cmd(env: dict, deploy_dir: str, command: str, workdir: str = "") -> list: - """构造远程主机的 bwrap 沙箱命令（通过 SSH 执行）。""" - # 远程主机上 bwrap 的路径（假设部署在 ~/bin/bwrap 或系统 PATH） - remote_bwrap = "bwrap" + """构造远程主机的 bwrap 沙箱参数（不含 bwrap 前缀，由调用方拼接探测逻辑）。""" parts = [ - remote_bwrap, "--unshare-user", "--unshare-pid", "--unshare-ipc", "--unshare-uts", "--die-with-parent", "--ro-bind", "/usr", "/usr", @@ -244,7 +241,9 @@ async def run_remote_sandbox(env: dict, deploy_dir: str, command: str, target = _ssh_target(env) bwrap_parts = _remote_bwrap_cmd(env, deploy_dir, command, workdir) - inner = " ".join(shlex.quote(p) for p in bwrap_parts) + bwrap_args = " ".join(shlex.quote(p) for p in bwrap_parts) + # 远程 shell 内探测 bwrap 路径（PATH 优先，回退 $HOME/bin/bwrap） + inner = 'BW=$(command -v bwrap 2>/dev/null || echo "$HOME/bin/bwrap"); exec "$BW" ' + bwrap_args ssh_cmd = ["ssh"] + ssh_args + [target, inner]