Skip to content

fix(cli): continue without network isolation when unavailable - #1379

Closed
EmilienM wants to merge 1 commit into
python-wheel-build:mainfrom
EmilienM:fix-isolation-fallback
Closed

EmilienM wants to merge 1 commit into
python-wheel-build:mainfrom
EmilienM:fix-isolation-fallback

Conversation

@EmilienM

Copy link
Copy Markdown
Contributor

Summary

When --network-isolation is given on a runner that cannot support it (for example Docker's default seccomp profile, which blocks the unshare syscall), fromager fails at startup with no workaround other than dropping the flag entirely.

This downgrades the hard failure to a warning and continues with isolation disabled for the rest of the run.

Testing

  • tests/test_external_commands.py and tests/test_cli.py pass
  • the changed path only executes on runners where network isolation is unavailable, so it is not reachable in CI

Fromager refuses to start when --network-isolation is given but the
platform cannot support it, for example under Docker's default seccomp
profile, which blocks the unshare syscall. The only workaround is to
drop the flag entirely.

Downgrade the hard failure to a warning and disable isolation for the
rest of the run so builds are not blocked by runner limitations.

Signed-off-by: Emilien Macchi <emacchi@redhat.com>
@EmilienM
EmilienM requested a review from a team as a code owner October 16, 2026 15:21
@coderabbitai

coderabbitai Bot commented Oct 16, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: Repository: python-wheel-build/fromager/.coderabbit.yaml
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 1c7baf7c-e746-4674-acd7-2bec5d07fbd5
📥 Commits

Reviewing files that changed from the base of the PR and between 45241aa and 8330d0a.

📒 Files selected for processing: 1
  • src/fromager/__main__.py

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

When network isolation is requested but unsupported, main now logs a warning with the detection error, disables network isolation, and continues execution.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Merge Risk: ⚪ Minimal · up to 8330d

The command warns and continues without network isolation when the runner cannot successfully execute the isolation probe. No concrete merge-blocking risk was established.

Pre-merge checks: Passed 4
Check name Status Explanation
Description check Passed The description clearly explains the change: unsupported network isolation now produces a warning and the run continues without isolation. It also includes testing information.
Title check Passed The title clearly and concisely summarizes the primary change: the CLI continues when network isolation is unavailable.
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@EmilienM

Copy link
Copy Markdown
Contributor Author

this was an experiment, do not merge it.

@EmilienM EmilienM closed this Oct 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant