search

cirruslabs / orchard

Orchestrator for running Tart Virtual Machines on a cluster of Apple Silicon devices
Other
194 stars 16 forks source link

Unable to acceptable host dir policy to enable VM remote mount #145

Closed ruimarinho closed 11 months ago

ruimarinho commented 11 months ago

Hi,

I'm trying to get the remote mount working in orchard but it seems like the policy validator is a bit too strict. If I execute:

orchard set cluster-settings --host-dir-policies=ghar:ro

❯ orchard get cluster-settings
Key                 Value
hostDir policies    ghar:ro

and then launch a new VM with the remote mount:

orchard create vm --image ghcr.io/cirruslabs/macos-sonoma-xcode:15 sonoma-xcode --memory 4295 --cpu 2 --headless=false --host-dirs=ghar:https://github.com/actions/runner/releases/download/v2.309.0/actions-runner-osx-arm64-2.309.0.tar.gz:ro

I get:

2023/10/24 11:45:52 API client encountered an API error to make a request: 400 Bad Request (host directory "ghar:https://github.com/actions/runner/releases/download/v2.309.0/actions-runner-osx-arm64-2.309.0.tar.gz:ro" is disallowed by policy, check your cluster settings)

Am I configuring the policy incorrectly? Thanks!

fkorotkov commented 11 months ago

Theoretically you should specify the URL in the policies for the Orchard Worker. But practically it doesn't yet working and it's getting fixed in #146

ruimarinho commented 11 months ago

I think the path prefix whitelisting is a good idea 👍

fkorotkov commented 11 months ago

Yeah, I initially though of just allowing archives by default but realized that they might contain symlink with absolute paths that potentially can allows escaping from the temporary directory.