nativelink
nativelink copied to clipboard
Update Local Remote Execution README
Some additional instruction/dependencies for using LRE on a fresh machine are:
- Needs to be run on a linux (ex ubuntu) machine
- Needs a policy file
- Needs docker.io with root access
To create a policy file run:
mkdir -p /etc/containers && sudo vi /etc/containers/policy.json
Then set the file contents to something like (This may be an unsafe configuration for a native work/personal machine, use caution when outside of a safe environment like an EC2 instance):
{
"default": [
{
"type": "insecureAcceptAnything"
}
]
}
I'm not going to add "insecureAcceptAnything"
to our repo without a lot of caveats. I'll think a policy file that is really easy for customers but doesn't cause problems.
Maybe the middle ground is that I can add a note further down with a more secure policy file or link to the policy file docs.
Yeah this should only be used in a safe environment like an EC2 instance.
But they do need to set a policy file if they don't have one, either we need to figure out a way to remove the requirement (I believe skopeo needs it though) or we can dig more into a safe configuration.
Probably would rather go with finding a safe configuration since expecting devs to pay that much attention to nuance in a README isn't exactly realistic at scale.
This should be re-defined as an internal only tool
LRE docs have been updated/made more precise and we added warnings that it's highly experimental tech. Closing for now - we can reopen if additional issues pop up.