Merge pull request #78 from chmeliik/network-isolation

image build: implement --hermetic

Author: chmeliik

cmd/internal.go

@@ -0,0 +1,17 @@
+package cmd
+
+import (
+	"github.com/spf13/cobra"
+
+	"github.com/konflux-ci/konflux-build-cli/cmd/internal"
+)
+
+var internalCmdGroup = &cobra.Command{
+	Use:    "internal",
+	Short:  "Internal subcommands, not intended for direct use",
+	Hidden: true,
+}
+
+func init() {
+	internalCmdGroup.AddCommand(internal.InUserNamespaceCmd)
+}

cmd/internal/in_user_namespace.go

@@ -0,0 +1,31 @@
+package internal
+
+import (
+	"github.com/spf13/cobra"
+
+	"github.com/konflux-ci/konflux-build-cli/pkg/commands"
+	l "github.com/konflux-ci/konflux-build-cli/pkg/logger"
+)
+
+var InUserNamespaceCmd = &cobra.Command{
+	Use:   "in-user-namespace [flags] command [args...]",
+	Short: "Run a command inside an externally created user namespace",
+	Long: `Run a command inside an externally created user namespace
+(e.g. by unshare or 'buildah unshare').
+
+Flags must come before the command. Everything after the first
+non-flag argument (or after --) is passed to the command as-is.`,
+	Example: `  buildah unshare -- unshare --net -- konflux-build-cli internal in-user-namespace --loopback-up -- buildah build .`,
+	Args: cobra.ArbitraryArgs,
+	Run: func(cmd *cobra.Command, args []string) {
+		loopbackUp, _ := cmd.Flags().GetBool("loopback-up")
+		if err := commands.RunInUserNamespace(loopbackUp, args); err != nil {
+			l.Logger.Fatal(err)
+		}
+	},
+}
+
+func init() {
+	InUserNamespaceCmd.Flags().SetInterspersed(false)
+	InUserNamespaceCmd.Flags().Bool("loopback-up", false, "Bring up the loopback interface before executing the command")
+}

cmd/root.go

@@ -51,4 +51,5 @@ func init() {
 	rootCmd.AddCommand(imageCmd)
 	rootCmd.AddCommand(PrefetchDependenciesCmd)
 	rootCmd.AddCommand(configCmd)
+	rootCmd.AddCommand(internalCmdGroup)
 }

go.mod

@@ -12,6 +12,7 @@ require (
 	github.com/opencontainers/image-spec v1.1.1
 	github.com/sirupsen/logrus v1.9.3
 	github.com/spf13/cobra v1.9.1
+	github.com/vishvananda/netlink v1.3.1
 	gopkg.in/ini.v1 v1.67.1
 	k8s.io/api v0.35.0
 	k8s.io/apimachinery v0.35.0
@@ -47,6 +48,7 @@ require (
 	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
 	github.com/spf13/pflag v1.0.9 // indirect
 	github.com/tonistiigi/go-csvvalue v0.0.0-20240710180619-ddb21b71c0b4 // indirect
+	github.com/vishvananda/netns v0.0.5 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect

go.sum

@@ -118,6 +118,10 @@ github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/tonistiigi/go-csvvalue v0.0.0-20240710180619-ddb21b71c0b4 h1:7I5c2Ig/5FgqkYOh/N87NzoyI9U15qUPXhDD8uCupv8=
 github.com/tonistiigi/go-csvvalue v0.0.0-20240710180619-ddb21b71c0b4/go.mod h1:278M4p8WsNh3n4a1eqiFcV2FGk7wE5fwUpUom9mK9lE=
+github.com/vishvananda/netlink v1.3.1 h1:3AEMt62VKqz90r0tmNhog0r/PpWKmrEShJU0wJW6bV0=
+github.com/vishvananda/netlink v1.3.1/go.mod h1:ARtKouGSTGchR8aMwmkzC0qiNPrrWO5JS/XMVl45+b4=
+github.com/vishvananda/netns v0.0.5 h1:DfiHV+j8bA32MFM7bfEunvT8IAqQ/NzSJHtcmW5zdEY=
+github.com/vishvananda/netns v0.0.5/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
@@ -150,6 +154,8 @@ golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5h
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
 golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/term v0.37.0 h1:8EGAD0qCmHYZg6J17DvsMy9/wJ7/D/4pV/wfnld5lTU=