|
|
|
@ -30,33 +30,15 @@ run_result runner::run_blocking(const program &program) {
|
|
|
|
|
posix_spawn_file_actions_addclose(&actions, in_pipe[0]);
|
|
|
|
|
posix_spawn_file_actions_addclose(&actions, out_pipe[1]);
|
|
|
|
|
posix_spawn_file_actions_addclose(&actions, err_pipe[1]);
|
|
|
|
|
const char *const docker_args[] = {"docker",
|
|
|
|
|
"run",
|
|
|
|
|
"--rm",
|
|
|
|
|
"-i",
|
|
|
|
|
"--pull=never",
|
|
|
|
|
"--cap-drop=ALL",
|
|
|
|
|
"--network=none",
|
|
|
|
|
"--memory=64m",
|
|
|
|
|
"--memory-swap=64m",
|
|
|
|
|
"--pids-limit=128",
|
|
|
|
|
program.image.c_str(),
|
|
|
|
|
nullptr};
|
|
|
|
|
const char *const bwrap_args[] = {
|
|
|
|
|
"bwrap", "--ro-bind", "/usr", "/usr", "--dir",
|
|
|
|
|
"/tmp", "--dir", "/var", "--proc", "/proc",
|
|
|
|
|
"--dev", "/dev", "--symlink", "usr/lib", "/lib",
|
|
|
|
|
"--symlink", "usr/lib64", "/lib64", "--symlink", "usr/bin",
|
|
|
|
|
"/bin", "--symlink", "usr/sbin", "/sbin", "--unshare-all",
|
|
|
|
|
"/bin/sh", nullptr};
|
|
|
|
|
const char *const docker_args[] = {"docker", "run", "--rm", "-i", "--pull=never", "--cap-drop=ALL", "--network=none", "--memory=64m", "--memory-swap=64m", "--pids-limit=128", program.image.c_str(), nullptr};
|
|
|
|
|
const char *const bwrap_args[] = {"bwrap", "--ro-bind", "/usr", "/usr", "--dir", "/tmp", "--dir", "/var", "--proc", "/proc", "--dev", "/dev", "--symlink", "usr/lib", "/lib", "--symlink", "usr/lib64", "/lib64", "--symlink", "usr/bin", "/bin", "--symlink", "usr/sbin", "/sbin", "--unshare-all", "/bin/sh", nullptr};
|
|
|
|
|
const char *const *args = docker_args;
|
|
|
|
|
if (backend == runner_backend::BubbleWrap) {
|
|
|
|
|
args = bwrap_args;
|
|
|
|
|
}
|
|
|
|
|
pid_t pid;
|
|
|
|
|
int exit_code;
|
|
|
|
|
if (posix_spawnp(&pid, args[0], &actions, nullptr,
|
|
|
|
|
const_cast<char *const *>(args), nullptr) != 0) {
|
|
|
|
|
if (posix_spawnp(&pid, args[0], &actions, nullptr, const_cast<char *const *>(args), nullptr) != 0) {
|
|
|
|
|
throw std::system_error{errno, std::generic_category()};
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
@ -70,19 +52,16 @@ run_result runner::run_blocking(const program &program) {
|
|
|
|
|
std::array<char, 1024> buffer{};
|
|
|
|
|
std::string out;
|
|
|
|
|
std::string err;
|
|
|
|
|
std::array<pollfd, 2> plist = {pollfd{out_pipe[0], POLLIN, 0},
|
|
|
|
|
pollfd{err_pipe[0], POLLIN, 0}};
|
|
|
|
|
std::array<pollfd, 2> plist = {pollfd{out_pipe[0], POLLIN, 0}, pollfd{err_pipe[0], POLLIN, 0}};
|
|
|
|
|
while (poll(plist.data(), plist.size(), /*timeout*/ -1) > 0) {
|
|
|
|
|
if (plist[0].revents & POLLIN) {
|
|
|
|
|
ssize_t bytes_read =
|
|
|
|
|
read(out_pipe[0], buffer.data(), buffer.size());
|
|
|
|
|
ssize_t bytes_read = read(out_pipe[0], buffer.data(), buffer.size());
|
|
|
|
|
if (bytes_read == -1) {
|
|
|
|
|
throw std::system_error{errno, std::generic_category()};
|
|
|
|
|
}
|
|
|
|
|
out.append(buffer.data(), bytes_read);
|
|
|
|
|
} else if (plist[1].revents & POLLIN) {
|
|
|
|
|
ssize_t bytes_read =
|
|
|
|
|
read(err_pipe[0], buffer.data(), buffer.size());
|
|
|
|
|
ssize_t bytes_read = read(err_pipe[0], buffer.data(), buffer.size());
|
|
|
|
|
if (bytes_read == -1) {
|
|
|
|
|
throw std::system_error{errno, std::generic_category()};
|
|
|
|
|
}
|
|
|
|
|