From 8330d0ae9adcd602710522d50337d17a6eab64b3 Mon Sep 17 00:00:00 2001 From: Emilien Macchi Date: Fri, 16 Oct 2026 10:54:42 -0400 Subject: [PATCH] fix(cli): continue without network isolation when unavailable Fromager refuses to start when --network-isolation is given but the platform cannot support it, for example under Docker's default seccomp profile, which blocks the unshare syscall. The only workaround is to drop the flag entirely. Downgrade the hard failure to a warning and disable isolation for the rest of the run so builds are not blocked by runner limitations. Signed-off-by: Emilien Macchi --- src/fromager/__main__.py | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/src/fromager/__main__.py b/src/fromager/__main__.py index 2ac6f4b5f..4f42f0841 100644 --- a/src/fromager/__main__.py +++ b/src/fromager/__main__.py @@ -262,7 +262,15 @@ def main( hooks.log_hooks() if network_isolation and not SUPPORTS_NETWORK_ISOLATION: - ctx.fail(f"network isolation is not available: {NETWORK_ISOLATION_ERROR}") + # Some CI runners (for example Docker's default seccomp profile) + # block the unshare syscall, which made fromager fail at startup + # with no workaround. Warn and continue without isolation instead + # of blocking the build. + logger.warning( + "network isolation is not available: %s; continuing without it", + NETWORK_ISOLATION_ERROR, + ) + network_isolation = False wkctx = context.WorkContext( active_settings=packagesettings.Settings.from_files(