yumoqing/pipeline-service
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: 远程沙箱 bwrap 路径探测（PATH 优先回退 ~/bin/bwrap）

Browse Source
This commit is contained in:
ymq 2026-08-14 11:15:03 +08:00
parent edd0a946a4
commit 7e0a3d1d93
1 changed files with 4 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
pipeline_service/work_env.py
View File

@ -213,11 +213,8 @@ def _row_to_env_from_dict(data: dict) -> dict:
# ═══════════════════════════════════════════════════════════ # ═══════════════════════════════════════════════════════════
def _remote_bwrap_cmd(env: dict, deploy_dir: str, command: str, workdir: str = "") -> list: def _remote_bwrap_cmd(env: dict, deploy_dir: str, command: str, workdir: str = "") -> list:
"""构造远程主机的 bwrap 沙箱命令（通过 SSH 执行）。""" """构造远程主机的 bwrap 沙箱参数（不含 bwrap 前缀，由调用方拼接探测逻辑）。"""
# 远程主机上 bwrap 的路径（假设部署在 ~/bin/bwrap 或系统 PATH）
remote_bwrap = "bwrap"
parts = [ parts = [
remote_bwrap,
"--unshare-user", "--unshare-pid", "--unshare-ipc", "--unshare-uts", "--unshare-user", "--unshare-pid", "--unshare-ipc", "--unshare-uts",
"--die-with-parent", "--die-with-parent",
"--ro-bind", "/usr", "/usr", "--ro-bind", "/usr", "/usr",
@ -244,7 +241,9 @@ async def run_remote_sandbox(env: dict, deploy_dir: str, command: str,
target = _ssh_target(env) target = _ssh_target(env)
bwrap_parts = _remote_bwrap_cmd(env, deploy_dir, command, workdir) bwrap_parts = _remote_bwrap_cmd(env, deploy_dir, command, workdir)
inner = " ".join(shlex.quote(p) for p in bwrap_parts) bwrap_args = " ".join(shlex.quote(p) for p in bwrap_parts)
# 远程 shell 内探测 bwrap 路径（PATH 优先，回退 $HOME/bin/bwrap）
inner = 'BW=$(command -v bwrap 2>/dev/null || echo "$HOME/bin/bwrap"); exec "$BW" ' + bwrap_args
ssh_cmd = ["ssh"] + ssh_args + [target, inner] ssh_cmd = ["ssh"] + ssh_args + [target, inner]