miki3421 opened a new pull request, #60: URL: https://github.com/apache/openserverless-admin-api/pull/60
Validate source and target image references and tenant ownership before job creation. Pass the target as an environment value instead of interpolating it into shell code. Run the pinned rootless BuildKit worker in a Kubernetes user namespace, without a service-account token or privileged mode, with a process sandbox and bounded subordinate-ID mappings. Deployment dependency: https://github.com/apache/openserverless-task/pull/237. The backport preserves the existing `/bin/extend` dependency-installation contract; it does not include Advanced automatic deploy or runtime fallback features. Seven focused unit tests passed. In the 0.9.0 lab, malformed source/target and cross-tenant target requests return HTTP 400. A valid request is accepted, but Kind 0.30.0 / Kubernetes 1.33.1 / containerd 2.1.1 fails creating the user-namespace pod with a sysfs mount permission error. A minimal non-builder user-namespace pod reproduces it. No isolation setting was relaxed. Kind compatibility will be tracked and fixed separately. The originating worker design was exercised on the Advanced K3s lab; this is not a claim that the exact backport has completed an end-to-end build on Kind. That runtime validation remains outstanding. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
