run: bind_try with a missing source skips the host-dst check #11

Merged

chad merged 1 commit from run/try-bind-missing-source-dst into master

2026-10-15 17:10:05 -04:00

glen commented

2026-10-15 17:08:23 -04:00

Collaborator

Root cause of the bubblebox-pkgs nightly failures since Oct 13 (runs 910–922) and today's failed full publish (run 115): lazydocker's smoke dies on bees, because its [[sandbox.bind_try]] of /var/run/docker.sock hit the bind-destination check.

The engine's own docs say bind_try "degrades cleanly on hosts without" the source — and bwrap's --bind-try does exactly that. But validate_bind_paths computed fires only for an empty-expanded source; a missing-but-named source still ran the host-overlaid destination check, which then hard-errored because /var/run/docker.sock doesn't exist on bees. The first release carrying the strict destination check (PR #1) was v0.3.0 — which is what pkgs CI pinned on Oct 13 (#25), exactly when the nightly went red. The repo itself is green: I reproduced the gate on bees for all 66 unpublished packages and they all build + smoke (the only failures in that run were my own bad args).

Fix: fires is now false for a try bind whose source is empty OR missing (and not create = true) — mirroring what bwrap actually does. A try bind with a present source still requires the host destination to exist.

bind_validation_try_bind_missing_source_skips_host_dst_check covers both halves (missing source → ok; present source + missing host dst → still an error).
The old bind_validation_host_view_dst_missing_is_an_error test codified the bug (it used a bind_try with a missing source); it now uses a required bind, which is the case that should hard-error.

cargo test --workspace: 136 pass.

Merge order: this should land before #10 (v0.4.1 bump) merges, so v0.4.1 carries the fix. Then: tag v0.4.1 → pkgs CI pin to v0.4.1 → re-dispatch publish (I'll do the dispatch) → the cache gains the 66 unpublished packages → cn's pnpm adoption PR unblocks.

Root cause of the bubblebox-pkgs nightly failures since Oct 13 (runs 910–922) and today's failed full publish (run 115): **lazydocker's smoke dies on bees**, because its `[[sandbox.bind_try]]` of `/var/run/docker.sock` hit the bind-destination check. The engine's own docs say bind_try "degrades cleanly on hosts without" the source — and bwrap's `--bind-try` does exactly that. But `validate_bind_paths` computed `fires` only for an *empty-expanded* source; a **missing-but-named** source still ran the host-overlaid destination check, which then hard-errored because `/var/run/docker.sock` doesn't exist on bees. The first release carrying the strict destination check (PR #1) was v0.3.0 — which is what pkgs CI pinned on Oct 13 (#25), exactly when the nightly went red. The repo itself is green: I reproduced the gate on bees for all 66 unpublished packages and they all build + smoke (the only failures in that run were my own bad args). **Fix:** `fires` is now false for a try bind whose source is empty OR missing (and not `create = true`) — mirroring what bwrap actually does. A try bind with a *present* source still requires the host destination to exist. - `bind_validation_try_bind_missing_source_skips_host_dst_check` covers both halves (missing source → ok; present source + missing host dst → still an error). - The old `bind_validation_host_view_dst_missing_is_an_error` test codified the bug (it used a bind_try with a missing source); it now uses a required bind, which is the case that should hard-error. `cargo test --workspace`: 136 pass. **Merge order:** this should land **before** #10 (v0.4.1 bump) merges, so v0.4.1 carries the fix. Then: tag v0.4.1 → pkgs CI pin to v0.4.1 → re-dispatch publish (I'll do the dispatch) → the cache gains the 66 unpublished packages → cn's pnpm adoption PR unblocks.

glen added 1 commit

2026-10-15 17:08:23 -04:00

run: bind_try with a missing source skips the host-dst check (lazydocker on bees) 0a74ec5f4d