You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@openserverless.apache.org by "miki3421 (via GitHub)" <gi...@apache.org> on 2026/10/14 10:54:25 UTC
[PR] Isolate builder jobs and validate image targets on 0.9.0 [openserverless-admin-api]
miki3421 opened a new pull request, #60:
URL: https://github.com/apache/openserverless-admin-api/pull/60
Validate source and target image references and tenant ownership before job creation. Pass the target as an environment value instead of interpolating it into shell code. Run the pinned rootless BuildKit worker in a Kubernetes user namespace, without a service-account token or privileged mode, with a process sandbox and bounded subordinate-ID mappings.
Deployment dependency: https://github.com/apache/openserverless-task/pull/237. The backport preserves the existing `/bin/extend` dependency-installation contract; it does not include Advanced automatic deploy or runtime fallback features.
Seven focused unit tests passed. In the 0.9.0 lab, malformed source/target and cross-tenant target requests return HTTP 400. A valid request is accepted, but Kind 0.30.0 / Kubernetes 1.33.1 / containerd 2.1.1 fails creating the user-namespace pod with a sysfs mount permission error. A minimal non-builder user-namespace pod reproduces it. No isolation setting was relaxed. Kind compatibility will be tracked and fixed separately.
The originating worker design was exercised on the Advanced K3s lab; this is not a claim that the exact backport has completed an end-to-end build on Kind. That runtime validation remains outstanding.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@openserverless.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Isolate builder jobs and validate image targets on 0.9.0 [openserverless-admin-api]
Posted by "miki3421 (via GitHub)" <gi...@apache.org>.
miki3421 commented on PR #60:
URL: https://github.com/apache/openserverless-admin-api/pull/60#issuecomment-6166844747
Kind compatibility is tracked in https://github.com/apache/openserverless/issues/273 and will be proposed separately for 0.9.3. This 0.9.0 PR does not include the Kind node preparation or explicit worker-state volume adjustments being tested there.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@openserverless.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Isolate builder jobs and validate image targets on 0.9.0 [openserverless-admin-api]
Posted by "sciabarracom (via GitHub)" <gi...@apache.org>.
sciabarracom merged PR #60:
URL: https://github.com/apache/openserverless-admin-api/pull/60
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@openserverless.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org