Search code examples
bazel

How do I require the sandbox?

I don't want users to accidentally disable the sandbox by leaving user namespaces disabled in their kernel, or through other mechanisms. I want to be able to trust their build results. How do I force the sandbox on through flags?

(The easiest way I've found to test this is to move /bin/true somewhere else momentarily and verify that Bazel refuses to build anything)

Solution

  • You can specify an explicit Spawn strategy instead of relying on the "pick the best available" algorithm:

    bazel build --spawn_strategy=linux-sandbox

    This will let builds fail with an error if user namespaces are not available. On macOS the name of the strategy is "darwin-sandbox".

    If you're building Java code, you might also want to either enable Worker sandboxing (--worker_sandboxing) or disable the persistent worker feature and compile Java inside the stricter sandbox (--strategy=Javac=linux-sandbox).