4 ms·

AFAIK Bazel does not use the sandbox by default. Last time I experimented with it, the sandbox had some problematic holes, but I don’t remember exactly what, an

AFAIK Bazel does not use the sandbox by default. Last time I experimented with it, the sandbox had some problematic holes, but I don’t remember exactly what, and it’s been a few years. The very doc you link hints at that, while also giving many caveats where the build will become non-reproducible. So it boils down to “yes, but only if you configure it correctly and do things right”.

jchw 2y ago
Yeah, I think you are right: by default, there is no OS-level sandboxing going on. According to documentation, the default spawn strategy is `local`[1], whereas it would need to be `sandboxed` for sandboxing to take effect. Meanwhile, if you want to forcibly block network access for a specific action, you can pass `block-network` as an execution requirement[2]. You can also explicitly block network access with flags, using --nosandbox_default_allow_network[3]. Interestingly though, an action can also `require-network` to bypass this, and I don't think there's any way to account for that. Maybe more importantly, Bazel lacks the concept of a fixed-output action, so when an impure action needs `require-network` the potentially-impure results could impact downstream dependents of actions. I was still ultimately incorrect to say that Bazel's sandbox can't sandbox the network. The actual reality is that it can. If you do enable the sandbox, while it's not exactly pervasive through the entire ecosystem, it does look like a fair number of projects at least set the `block-network` tag--about 700 as of writing this[4]. I think the broader point I was making (that Nix adheres to a stronger standard of "hermetic" than Bazel) is ultimately true, but I did miss on a bit of nuance initially. [1]: https://bazel.build/docs/user-manual#spawn-strategy https://bazel.build/docs/user-manual#spawn-strategy [2]: https://bazel.build/reference/be/common-definitions#common.tags https://bazel.build/reference/be/common-definitions#common.t... [3]: https://bazel.build/reference/command-line-reference#flag--sandbox_default_allow_network https://bazel.build/reference/command-line-reference#flag--s... [4]: https://github.com/search?q=language%3Abzl+%22block-network%22&type=code https://github.com/search?q=language%3Abzl+%22block-network%...

jchw 2y ago

Yeah, I think you are right: by default, there is no OS-level sandboxing going on. According to documentation, the default spawn strategy is `local`[1], whereas it would need to be `sandboxed` for sandboxing to take effect. Meanwhile, if you want to forcibly block network access for a specific action, you can pass `block-network` as an execution requirement[2]. You can also explicitly block network access with flags, using --nosandbox_default_allow_network[3]. Interestingly though, an action can also `require-network` to bypass this, and I don't think there's any way to account for that. Maybe more importantly, Bazel lacks the concept of a fixed-output action, so when an impure action needs `require-network` the potentially-impure results could impact downstream dependents of actions. I was still ultimately incorrect to say that Bazel's sandbox can't sandbox the network. The actual reality is that it can. If you do enable the sandbox, while it's not exactly pervasive through the entire ecosystem, it does look like a fair number of projects at least set the `block-network` tag--about 700 as of writing this[4]. I think the broader point I was making (that Nix adheres to a stronger standard of "hermetic" than Bazel) is ultimately true, but I did miss on a bit of nuance initially. [1]: https://bazel.build/docs/user-manual#spawn-strategy https://bazel.build/docs/user-manual#spawn-strategy [2]: https://bazel.build/reference/be/common-definitions#common.tags https://bazel.build/reference/be/common-definitions#common.t... [3]: https://bazel.build/reference/command-line-reference#flag--sandbox_default_allow_network https://bazel.build/reference/command-line-reference#flag--s... [4]: https://github.com/search?q=language%3Abzl+%22block-network%22&type=code https://github.com/search?q=language%3Abzl+%22block-network%...