2 ms·
> it's actually opt-in for network isolation Bazel enables sandboxing by default, including network isolation. [1] [2] The exception would be in environments
by paulddraper 2y ago
> it's actually opt-in for network isolation
Bazel enables sandboxing by default, including network isolation. [1] [2]
The exception would be in environments that don't support it (Windows, unprivileged Docker container, etc.)
[1] https://bazel.build/docs/user-manual#spawn-strategy https://bazel.build/docs/user-manual#spawn-strategy
[2] https://stackoverflow.com/a/63635141 https://stackoverflow.com/a/63635141
- jchw 2y agoMy assertion that network isolation is opt-in is based on the fact that the --sandbox_default_allow_network defaults to true[1]. That suggests actions will have networking unless they are dispatched with `block-network`[2]. (It's hard to figure out exactly what's going on based on the documentation and some crawling around, but I wouldn't be surprised if specifically tests defaulted to blocking the network.) [1]: https://bazel.build/reference/command-line-reference#flag--sandbox_default_allow_network https://bazel.build/reference/command-line-reference#flag--s... [2]: https://bazel.build/reference/be/common-definitions#common.tags https://bazel.build/reference/be/common-definitions#common.t...