nativelink icon indicating copy to clipboard operation
nativelink copied to clipboard

Update Local Remote Execution README

Open blakehatch opened this issue 1 year ago • 3 comments

Some additional instruction/dependencies for using LRE on a fresh machine are:

  1. Needs to be run on a linux (ex ubuntu) machine
  2. Needs a policy file
  3. Needs docker.io with root access

To create a policy file run:

mkdir -p /etc/containers && sudo vi /etc/containers/policy.json

Then set the file contents to something like (This may be an unsafe configuration for a native work/personal machine, use caution when outside of a safe environment like an EC2 instance):

{
  "default": [
    {
      "type": "insecureAcceptAnything"
    }
  ]
}

blakehatch avatar Feb 20 '24 16:02 blakehatch

I'm not going to add "insecureAcceptAnything" to our repo without a lot of caveats. I'll think a policy file that is really easy for customers but doesn't cause problems.

Maybe the middle ground is that I can add a note further down with a more secure policy file or link to the policy file docs.

MarcusSorealheis avatar Feb 21 '24 08:02 MarcusSorealheis

Yeah this should only be used in a safe environment like an EC2 instance.

But they do need to set a policy file if they don't have one, either we need to figure out a way to remove the requirement (I believe skopeo needs it though) or we can dig more into a safe configuration.

Probably would rather go with finding a safe configuration since expecting devs to pay that much attention to nuance in a README isn't exactly realistic at scale.

blakehatch avatar Feb 21 '24 17:02 blakehatch

This should be re-defined as an internal only tool

bclark8923 avatar Mar 16 '24 19:03 bclark8923

LRE docs have been updated/made more precise and we added warnings that it's highly experimental tech. Closing for now - we can reopen if additional issues pop up.

aaronmondal avatar Jun 29 '24 01:06 aaronmondal