Welcome to post 60 in the R4 series.
bubblewrap is a great tool and very suitable for using with an agent harness. It is a very compelling—and lightweight—alternative to using a full-blown docker container as it offers low-level unprivileged sandboxing on Linux hosts.
In a nutshell, bubblewrap can ‘turn
everything off’ (see unshare-all below) and allow access
only to selected services and directories (as shown below). This makes
it a very useful tool be used on a main workstation as it can provide a
lower-risk deployment quite easily while taking advantage of the already
installed software stack. I continue to get a lot of value out of docker, especially as r2u makes installing R
package dependencies so trivial. Its slogan ‘easy, fast, reliable: pick
all three’ clearly holds for r2u. But sometimes bubblewrap is
compelling, for example to launch opencode (documented for example at the
debian-inference
site).
When using R we need add more
directories to the example to provide /etc/alternatives
which is governing inter alia the LAPACK / BLAS resolution on
Debian / Ubuntu systems; this is now on debian-inference
site but wasn’t when I first tried it a few days ago ;-) as well as
/etc/R for config files and possibly
~/.R/Makevars for compiler settings. With that my current
wrapper is
#!/bin/bash
#
# cf https://inference.debian.net/doc
# and 'curl' command to set bearer code
bwrap \
--ro-bind /usr /usr \
--symlink usr/bin /bin \
--symlink usr/lib /lib \
--symlink usr/lib64 /lib64 \
--ro-bind /etc/ssl /etc/ssl \
--ro-bind /etc/resolv.conf /etc/resolv.conf \
--ro-bind $HOME/.gitconfig $HOME/.gitconfig \
--bind $HOME/.config/opencode $HOME/.config/opencode \
--bind $HOME/.cache/opencode $HOME/.cache/opencode \
--bind $HOME/.opencode $HOME/.opencode \
--bind $HOME/.local/share/opencode $HOME/.local/share/opencode \
--bind $HOME/.local/state/opencode $HOME/.local/state/opencode \
--ro-bind $HOME/.R/Makevars $HOME/.R/Makevars \
--ro-bind /etc/R/ /etc/R \
--ro-bind /etc/alternatives/ /etc/alternatives \
--proc /proc \
--dev /dev \
--tmpfs /tmp \
--bind $(pwd) $(pwd) \
--chdir $(pwd) \
--unshare-all \
--share-net \
--die-with-parent \
/usr/local/bin/opencode "$@"Launched that way we can have agents use R to check packages sources,
builds, and triage for bugs. this works equally well with local models
served via ollama (and with that a
quick shoutout to packages.lingfish.net for
providing an apt service for ollama) as it does with the various
cloud-based offerings. So harness away with R!
This post by Dirk Eddelbuettel originated on his Thinking inside the box blog. If you like this or other open-source work I do, you can now sponsor me at GitHub.