Skip to content

ci: let bwrap create user namespaces on the runner so the sandbox test runs #1209

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ZhuchkaTriplesix merged 1 commit into from
Oct 9, 2026
Merged

ci: let bwrap create user namespaces on the runner so the sandbox test runs #1209

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 3 additions & 12 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,18 +51,9 @@ jobs:
sudo apt-get $APT update
# bubblewrap runs the extension sandbox tests; without it they skip.
sudo apt-get $APT install -y libsecret-1-dev bubblewrap

# TEMPORARY diagnostics: why the sandbox probe in the extension tests
# cannot run on this runner. Remove once the sandbox test runs.
- name: Diagnose bubblewrap
if: runner.environment == 'github-hosted'
continue-on-error: true
run: |
sudo apt-get install -y bubblewrap >/dev/null 2>&1 || true
bwrap --ro-bind / / /bin/true; echo "bwrap exit=$?"
bwrap --unshare-user --ro-bind / / /bin/true; echo "bwrap userns exit=$?"
sysctl kernel.apparmor_restrict_unprivileged_userns kernel.unprivileged_userns_clone 2>&1 || true
ls /etc/apparmor.d | grep -i bwrap || echo "no bwrap apparmor profile"
# Ubuntu 24.04 blocks unprivileged user namespaces for bwrap ("setting
# up uid map: Permission denied"). This relaxes it on the CI VM only.
sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0

- name: Get dependencies
run: flutter pub get
Expand Down
Loading