Eelco Dolstra df716c98d2 In chroot builds, use a private network namespace ... On Linux it's possible to run a process in its own network namespace, meaning that it gets its own set of network interfaces, disjunct from the rest of the system. We use this to completely remove network access to chroot builds, except that they get a private loopback interface. This means that: - Builders cannot connect to the outside network or to other processes on the same machine, except processes within the same build. - Vice versa, other processes cannot connect to processes in a chroot build, and open ports/connections do not show up in "netstat". - If two concurrent builders try to listen on the same port (e.g. as part of a test), they no longer conflict with each other. This was inspired by the "PrivateNetwork" flag in systemd.		2012-06-23 00:28:35 -04:00
..
build.cc	In chroot builds, use a private network namespace	2012-06-23 00:28:35 -04:00
derivations.cc	* Ouch. A store upgrade could cause a substituter to be triggered,	2011-09-12 09:07:43 +00:00
derivations.hh	* Eliminate all uses of the global variable ‘store’ from libstore.	2011-08-31 21:11:50 +00:00
gc.cc	Fix obscure race condition in GC root creation	2012-04-16 18:47:01 +02:00
globals.cc	* Move initialisation of variables like nixConfDir from libmain to	2011-11-22 17:28:41 +00:00
globals.hh	* Move initialisation of variables like nixConfDir from libmain to	2011-11-22 17:28:41 +00:00
local-store.cc	Reserve some disk space for the garbage collector	2012-05-29 22:59:12 -04:00
local-store.hh	Reserve some disk space for the garbage collector	2012-05-29 22:59:12 -04:00
Makefile.am	Compress build logs on the fly using bzip2	2012-05-30 10:12:29 -04:00
misc.cc	* Add an option ‘build-use-substitutes’, which can be set to ‘false’	2012-04-30 19:15:34 -04:00
misc.hh	* Eliminate all uses of the global variable ‘store’ from libstore.	2011-08-31 21:11:50 +00:00
optimise-store.cc	On Linux, make the Nix store really read-only by using the immutable bit	2012-02-15 01:31:56 +01:00
pathlocks.cc	Set the close-on-exec flag on file descriptors	2012-03-05 20:29:00 +01:00
pathlocks.hh	* Revert r19797, and use a simpler solution: just don't monitor build	2010-02-03 21:38:41 +00:00
references.cc	Use data() instead of c_str() where appropriate	2012-02-09 18:27:45 +01:00
references.hh	* Store the size of a store path in the database (to be precise, the	2010-11-16 17:11:46 +00:00
remote-store.cc	Reserve some disk space for the garbage collector	2012-05-29 22:59:12 -04:00
remote-store.hh	Reserve some disk space for the garbage collector	2012-05-29 22:59:12 -04:00
schema.sql	* Store the size of a store path in the database (to be precise, the	2010-11-16 17:11:46 +00:00
store-api.cc	Reserve some disk space for the garbage collector	2012-05-29 22:59:12 -04:00
store-api.hh	Reserve some disk space for the garbage collector	2012-05-29 22:59:12 -04:00
worker-protocol.hh	Reserve some disk space for the garbage collector	2012-05-29 22:59:12 -04:00