kemko/nomad
1
0
Fork 0
mirror of https://github.com/kemko/nomad.git synced 2026-01-01 16:05:42 +03:00
Code Issues Packages Projects Releases Wiki Activity

[artifact] add artifact inspection after download (#26608)

Browse Source 
This adds artifact inspection after download to detect any issues
with the content fetched. Currently this means checking for any
symlinks within the artifact that resolve outside the task or
allocation directories. On platforms where lockdown is available
(some Linux) this inspection is not performed.

The inspection can be disabled with the DisableArtifactInspection
option. A dedicated option for disabling this behavior allows
the DisableFilesystemIsolation option to be enabled but still
have artifacts inspected after download.
This commit is contained in:
Chris Roberts
2025-08-27 10:37:34 -07:00
committed by GitHub
parent e5eb125264
commit fd1e40537c
14 changed files with 347 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
website/content/docs/configuration/client.mdx
View File

@@ -488,6 +488,11 @@ refer to the [drivers documentation](/nomad/docs/job-declare/task-driver).
of files that will be decompressed before triggering an error and cancelling the
operation. Set to `0` to not enforce a limit.
- `disable_artifact_inspection` `(bool: false)` - Specifies whether to disable
artifact inspection for sandbox escapes. If the platform supports filesystem
isolation, and it is not disabled, artifact inspection will not be performed
regardless of this value.
- `disable_filesystem_isolation` `(bool: false)` - Specifies whether filesystem
isolation should be disabled for artifact downloads. Applies only to systems
where filesystem isolation via [landlock] is possible (Linux kernel 5.13+).