Clone this repo:

Branches

  1. 3658687 [sanddune]: log owning_process info by Yulan Lin · 12 days ago main
  2. 46054f3 [sanddune]: fix misc compile warnings by Yulan Lin · 12 days ago
  3. 8548e05 [sanddune]: Replace dnsparser & fix integration test by Yulan Lin · 12 days ago
  4. d4e5513 [sanddune]: pointer resolution test by Camilo Jacomet · 12 days ago
  5. 052f3fc [sanddune]: add first pass test for packet by Yulan Lin · 12 days ago

SandDune

What is SandDune?

Sanddune is an experimental hermetic build sandbox for Chrome builds that builds off of the core hypervisor ideas from gvisor. The goal would be to isolate builds, trap syscalls and network requests to assert the hermeticity of builds.

It was forked from gvisor at commit 3ff7324.

The documentation below is from gvisor and will eventually be deleted or updated as we plan to remove everything that isn't directly related to the goal of hermetic assertions.

Documentation

User documentation and technical architecture, including quick start guides, can be found at gvisor.dev.

Installing from source

gVisor builds on x86_64 and ARM64. Other architectures may become available in the future.

For the purposes of these instructions, bazel and other build dependencies are wrapped in a build container. It is possible to use bazel directly, or type make help for standard targets.

Requirements

Make sure the following dependencies are installed:

Building

Build and install the runsc binary:

make runsc
sudo cp ./bazel-bin/runsc/linux_amd64_pure_stripped/runsc /usr/local/bin

Testing

To run standard test suites, you can use:

make unit-tests
make tests

To run specific tests, you can specify the target:

make test TARGETS="//runsc:version_test"

Using go get

This project uses bazel to build and manage dependencies. A synthetic go branch is maintained that is compatible with standard go tooling for convenience.

For example, to build and install runsc directly from this branch:

echo "module runsc" > go.mod
GO111MODULE=on go get gvisor.dev/gvisor/runsc@go
CGO_ENABLED=0 GO111MODULE=on sudo -E go build -o /usr/local/bin/runsc gvisor.dev/gvisor/runsc

Subsequently, you can build and install the shim binaries for containerd:

GO111MODULE=on sudo -E go build -o /usr/local/bin/gvisor-containerd-shim gvisor.dev/gvisor/shim/v1
GO111MODULE=on sudo -E go build -o /usr/local/bin/containerd-shim-runsc-v1 gvisor.dev/gvisor/shim/v2

Note that this branch is supported in a best effort capacity, and direct development on this branch is not supported. Development should occur on the master branch, which is then reflected into the go branch.