diff options
| author | Ahmed Abdelhalim <[email protected]> | 2026-07-21 17:32:47 +0200 |
|---|---|---|
| committer | Ahmed Abdelhalim <[email protected]> | 2026-07-21 17:32:47 +0200 |
| commit | 6498bf7eb61b8c0bffe0bb23f6ab49edd4a99b5a (patch) | |
| tree | 0136c0a3bd64bc9ee81f03ca5405e9ec29c30592 /molecule/archlinux | |
| parent | ca9887078e68a6ec02bce94a38db0c2d954c14ba (diff) | |
Disable pacman sandbox in archlinux molecule image for QEMU compat
pacman 7.0+'s alpm sandbox runs package download/extraction under a
restricted user + seccomp filter. That filter needs syscalls QEMU's
user-mode emulation doesn't support, so building this amd64 image on an
arm64 host (e.g. Apple Silicon) fails immediately on the first pacman
call:
error: error restricting syscalls via seccomp: 22!
error: switching to sandbox user 'alpm' failed!
Confirmed directly: `pacman -Sy` fails with the sandbox enabled and
succeeds cleanly with `DisableSandbox` set in pacman.conf.
Scoped entirely to this test image, not any real role/target this repo
manages. Safe for CI too — the sandbox is a defense-in-depth layer
protecting the host from a compromised download during package fetch,
irrelevant to a container that's destroyed immediately after each test
run; disabling it changes no package-resolution or install behavior,
only removes that extra isolation layer. Native (non-emulated) CI
runners were never affected by the underlying bug either way.
Co-Authored-By: Claude.ai
Diffstat (limited to 'molecule/archlinux')
| -rw-r--r-- | molecule/archlinux/Dockerfile.j2 | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/molecule/archlinux/Dockerfile.j2 b/molecule/archlinux/Dockerfile.j2 index 9e25e4f3..fd6791e7 100644 --- a/molecule/archlinux/Dockerfile.j2 +++ b/molecule/archlinux/Dockerfile.j2 @@ -2,6 +2,14 @@ FROM docker.io/library/archlinux ENV container docker +# pacman's syscall sandbox (alpm) doesn't work under QEMU user-mode +# emulation (e.g. building amd64 images on an arm64 host): the sandbox's +# seccomp filter needs syscalls QEMU doesn't emulate, so pacman fails +# with "error restricting syscalls via seccomp" before ever reaching the +# network. Disabling it only affects local cross-arch testing; native +# CI runners aren't emulated and are unaffected either way. +RUN sed -i '/^\[options\]/a DisableSandbox' /etc/pacman.conf + RUN pacman -Syu --noconfirm --needed python3 systemd udev dbus \ && pacman -Scc --noconfirm |