Enabling strict action env by default

[Jakob Buchgraber]

TL;DR; we would like to change the default value of --experimental_strict_action_env from false to true [1].

Hi,

by default actions in Bazel are executed in a shell environment that inherits PATH and LD_LIBRARY_PATH from the host environment (the shell environment Bazel is invoked in). That's problematic for remote caching and execution in Bazel, as the values of environment variables are included in cache key computations. So two users with different PATH variables are not able to share cache hits. For this reason we introduced --experimental_strict_action_env which sets PATH for actions to a fixed value ("/bin:/usr/bin" on Linux) and does not set LD_LIBRARY_PATH at all. This can break rules that depend on these variables being passed in from the host environment but I am not aware of any such breakages at this point.

This flag has been in Bazel for over a year now and we would like to enable it by default in one of the next releases. Users will be able to disable it by specifying --noexperimental_strict_action_env. Additionally, one can pass environment variables to actions in a safe way by specifying them via --action_env flags.

I would be interested to learn about your opinions/concerns about making this change!

Thanks,

Jakob

[1] https://github.com/bazelbuild/bazel/pull/6263

Jakob Buchgraber

Software Engineer

Google Germany GmbH

Erika-Mann-Straße 33

80636 München

Geschäftsführer: Paul Manicle, Halimah DeLaine Prado

Registergericht und -nummer: Hamburg, HRB 86891

Sitz der Gesellschaft: Hamburg

Diese E-Mail ist vertraulich. Falls sie diese fälschlicherweise erhalten haben sollten, leiten Sie diese bitte nicht an jemand anderes weiter, löschen Sie alle Kopien und Anhänge davon und lassen Sie mich bitte wissen, dass die E-Mail an die falsche Person gesendet wurde.

    

This e-mail is confidential. If you received this communication by mistake, please don't forward it to anyone else, please erase all copies and attachments, and please let me know that it has gone to the wrong person.

[George Gensure]

+1

We've been doing something like this in a wrapper since adopting bazel and remote caching 18 months ago

--
You received this message because you are subscribed to the Google Groups "bazel-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bazel-discus...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/bazel-discuss/CAGQ4vn1LVt6DpengGbkeuOvh56q_WhTTio%2BkDJjLCTdr79FtQA%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

[Ed Schouten]

Op ma 1 okt. 2018 om 13:12 schreef 'Jakob Buchgraber' via
bazel-discuss <bazel-...@googlegroups.com>:

> TL;DR; we would like to change the default value of --experimental_strict_action_env from false to true [1].

+1

--
Ed Schouten <e...@nuxi.nl>