Repository: openllb/hlb
Pull request #118 (2020-04-22 05:01:06)

Set allowed entitlements on solve opt to allow changing network and security mode
- Currently, you are not allowed to change `network "host"` or `security "insecure"`. Ported over the `AllowedEntitlements` from `buildctl`.
- However, this still requires the `buildkitd` side to also allow these entitlements, so it won't work on cloud build.
```
#1 DONE 0.0s
ERROR   failed to solve: rpc error: code = Unknown desc = failed to load LLB: security.insecure is not allowed
```


Patch:
diff --git a/codegen/codegen.go b/codegen/codegen.go
index e4e0b96..7f30911 100644
--- a/codegen/codegen.go
+++ b/codegen/codegen.go
@@ -26,6 +26,7 @@ import (
 	"github.com/moby/buildkit/session/filesync"
 	"github.com/moby/buildkit/session/secrets/secretsprovider"
 	"github.com/moby/buildkit/solver/pb"
+	"github.com/moby/buildkit/util/entitlements"
 	digest "github.com/opencontainers/go-digest"
 	specs "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/openllb/hlb/checker"
@@ -912,6 +913,7 @@ func (cg *CodeGen) EmitExecOptions(ctx context.Context, scope *parser.Scope, op
 					netMode = pb.NetMode_UNSET
 				case "host":
 					netMode = pb.NetMode_HOST
+					cg.solveOpts = append(cg.solveOpts, solver.WithEntitlement(entitlements.EntitlementNetworkHost))
 				case "node":
 					netMode = pb.NetMode_NONE
 				default:
@@ -931,6 +933,7 @@ func (cg *CodeGen) EmitExecOptions(ctx context.Context, scope *parser.Scope, op
 					securityMode = pb.SecurityMode_SANDBOX
 				case "insecure":
 					securityMode = pb.SecurityMode_INSECURE
+					cg.solveOpts = append(cg.solveOpts, solver.WithEntitlement(entitlements.EntitlementSecurityInsecure))
 				default:
 					return opts, errors.WithStack(ErrCodeGen{args[0], errors.Errorf("unknown security mode")})
 				}
diff --git a/solver/request.go b/solver/request.go
index 92dec91..5dabed6 100644
--- a/solver/request.go
+++ b/solver/request.go
@@ -216,7 +216,12 @@ func (o op) Tree(tree treeprint.Tree) error {
 	if o.info.OutputLocalOCITarball {
 		solve.AddNode("downloadOCITarball")
 	}
-
+	if len(o.info.Entitlements) > 0 {
+		ent := solve.AddBranch("entitlements")
+		for _, entitlements := range o.info.Entitlements {
+			ent.AddNode(string(entitlements))
+		}
+	}
 	for _, input := range pbOp.Inputs {
 		if _, ok := reportedInputs[input.Digest]; ok {
 			continue
diff --git a/solver/solve.go b/solver/solve.go
index 000e776..9b3b85f 100644
--- a/solver/solve.go
+++ b/solver/solve.go
@@ -10,6 +10,7 @@ import (
 	"github.com/moby/buildkit/exporter/containerimage/exptypes"
 	gateway "github.com/moby/buildkit/frontend/gateway/client"
 	"github.com/moby/buildkit/session"
+	"github.com/moby/buildkit/util/entitlements"
 	specs "github.com/opencontainers/image-spec/specs-go/v1"
 	"golang.org/x/sync/errgroup"
 )
@@ -24,6 +25,7 @@ type SolveInfo struct {
 	OutputLocalOCITarball bool
 	Callbacks             []func() error `json:"-"`
 	ImageSpec             *specs.Image
+	Entitlements          []entitlements.Entitlement
 }
 
 func WithDownloadDockerTarball(ref string) SolveOption {
@@ -75,6 +77,13 @@ func WithImageSpec(cfg *specs.Image) SolveOption {
 	}
 }
 
+func WithEntitlement(e entitlements.Entitlement) SolveOption {
+	return func(info *SolveInfo) error {
+		info.Entitlements = append(info.Entitlements, e)
+		return nil
+	}
+}
+
 func Solve(ctx context.Context, c *client.Client, s *session.Session, pw progress.Writer, def *llb.Definition, opts ...SolveOption) error {
 	info := &SolveInfo{}
 	for _, opt := range opts {
@@ -116,6 +125,7 @@ func Build(ctx context.Context, c *client.Client, s *session.Session, pw progres
 	solveOpt := client.SolveOpt{
 		SharedSession:         s,
 		SessionPreInitialized: s != nil,
+		AllowedEntitlements:   info.Entitlements,
 	}
 
 	if info.OutputDockerRef != "" {


Test patch:
diff --git a/codegen/codegen_test.go b/codegen/codegen_test.go
index 8553899..e7c4da5 100644
--- a/codegen/codegen_test.go
+++ b/codegen/codegen_test.go
@@ -7,6 +7,8 @@ import (
 	"testing"
 
 	"github.com/moby/buildkit/client/llb"
+	"github.com/moby/buildkit/solver/pb"
+	"github.com/moby/buildkit/util/entitlements"
 	"github.com/openllb/hlb/checker"
 	"github.com/openllb/hlb/parser"
 	"github.com/openllb/hlb/solver"
@@ -292,6 +294,29 @@ func TestCodeGen(t *testing.T) {
 				llb.Shlexf("echo hi %s", os.Getenv("USER")),
 			).Root())
 		},
+	}, {
+		"entitlements",
+		[]string{"default"},
+		`
+		fs default() {
+			image "busybox"
+			run "entitlements" with option {
+				network "host"
+				security "insecure"
+			}
+		}
+		`,
+		func(t *testing.T, cg *CodeGen) solver.Request {
+			return Expect(t,
+				llb.Image("busybox").Run(
+					llb.Shlex("entitlements"),
+					llb.Network(pb.NetMode_HOST),
+					llb.Security(pb.SecurityMode_INSECURE),
+				).Root(),
+				solver.WithEntitlement(entitlements.EntitlementNetworkHost),
+				solver.WithEntitlement(entitlements.EntitlementSecurityInsecure),
+			)
+		},
 	}} {
 		tc := tc
 		t.Run(tc.name, func(t *testing.T) {