port isolation with bazel inside docker

Question

Trying to test out port isolation with bazel and linux inside docker privileged container and it fails.

My env is as following (all commands ran from priviliged container that ran started on aws):

$ uname -a
Linux 167-docker99 3.16.0-4-amd64 #1 SMP Debian 3.16.43-2 (2017-04-30) x86_64 GNU/Linux
builduser@167-docker99:~/ws/bazel-port-isolation$ cat /etc/*-release
PRETTY_NAME="Debian GNU/Linux 8 (jessie)"
NAME="Debian GNU/Linux"
VERSION_ID="8"
VERSION="8 (jessie)"
ID=debian
HOME_URL="http://www.debian.org/"
SUPPORT_URL="http://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"Bazel version

$ bazel version
Build label: 0.5.1
Build target: bazel-out/local-fastbuild/bin/src/main/java/com/google/devtools/build/lib/bazel/BazelServer_deploy.jar
Build time: Tue Jun 6 10:34:11 2017 (1496745251)
Build timestamp: 1496745251
Build timestamp as int: 1496745251

According to this instruction - made sure unprivileged_userns_clone enabled.

$ cat /proc/sys/kernel/unprivileged_userns_clone 
1

The repo: https://github.com/ittaiz/bazel-port-isolation

Running the test: $ bazel test //...

...........
____Loading package:
____Loading package: @bazel_tools//tools/cpp
____Loading package: @local_config_xcode//
____Loading package: @local_jdk//
____Loading package: @local_config_cc//
____Loading complete.  Analyzing...
____Loading package: tools/defaults
____Loading package: @bazel_tools//tools/test
____Loading package: @junit_junit//jar
____Found 2 test targets...
____Building...
____[0 / 12] Expanding template SocketIsolationTest
____[9 / 12] Extracting interface @junit_junit//jar:jar ERROR: /home/builduser/.cache/bazel/_bazel_builduser/a589c0f8758972ab3aadcf172c468873/external/junit_junit/jar/BUILD.bazel:2:1: Extracting interface @junit_junit//jar:jar failed: Process exited with status 1 [sandboxed]. src/main/tools/linux-sandbox-pid1.cc:193: "mount(/tmp, /tmp, NULL, MS_BIND, NULL)": Invalid argument Use
--strategy=JavaIjar=standalone to disable sandboxing for the failing actions.
____Building complete.
____Elapsed time: 5.651s, Critical Path: 1.62s //:SocketIsolation2Test                                               NO STATUS

Executed 0 out of 2 tests: 1 fails to build and 1 was skipped.

Another important input maybe is that I did manage to make bazel run the tests successfully on the docker host.

What went wrong?

Answer 1

Seems like it was fixed on HEAD (baf7d4bce8bb14d785760d10694122e8ead2a177).

After installing bazel HEAD it passed successfully