Skip to content

trading_agent.doctor.checks.bubblewrap_check

Checks that bwrap can start a sandbox, which the bash terminal needs.

Some Linux systems block the unprivileged namespaces bwrap uses, so the check starts a real, empty sandbox rather than only looking for the program.

Typical usage example:

result = BubblewrapCheck().run()

BubblewrapCheck

Bases: DoctorCheck

Checks the bwrap sandbox.

run 

run()

Runs true inside a read-only bwrap sandbox.

Returns:

Type Description
CheckResult

OK when the sandbox starts, failed otherwise.
Source code in src/trading_agent/doctor/checks/bubblewrap_check.py 
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
def run(self) -> doctor_check.CheckResult:
    """Runs `true` inside a read-only bwrap sandbox.

    Returns:
        doctor_check.CheckResult: OK when the sandbox starts, failed otherwise.
    """
    bwrap_path = shutil.which('bwrap')
    if bwrap_path is None:
        return doctor_check.CheckResult(
            doctor_check.CheckStatus.FAILED,
            'bwrap is not installed; run: sudo apt install bubblewrap',
        )
    completed = subprocess.run(
        [
            bwrap_path,
            '--ro-bind',
            '/',
            '/',
            '--dev',
            '/dev',
            '--proc',
            '/proc',
            '--unshare-pid',
            'true',
        ],
        capture_output=True,
        text=True,
        timeout=_TIMEOUT_SECONDS,
        check=False,
    )
    if completed.returncode != 0:
        return doctor_check.CheckResult(
            doctor_check.CheckStatus.FAILED,
            f'bwrap could not start a sandbox: {completed.stderr.strip()}',
        )
    return doctor_check.CheckResult(
        doctor_check.CheckStatus.OK,
        'A test sandbox started and exited cleanly.',
    )