Explicitly adding a mount pair for file in the user's home directory

[bd-tkoolen]

In an attempt to increase hermeticity, we're interested in enabling --experimental_use_hermetic_linux_sandbox and then explicitly adding --sandbox_add_mount_pairs. However, we need to make the user's ~/.netrc file available in the sandbox. Is there any way to do that in a way that doesn't hardcode the absolute path of the user's home directory? We don't want to mount all of /home.

[dragos250]

Install Bazelisk. It allows you to have a bash script wrapper called tools/bazel (https://github.com/bazelbuild/bazelisk?tab=readme-ov-file#ensuring-that-your-developers-use-bazelisk-rather-than-bazel) that can set up your variables and then it calls Bazel. Because .bazelrc doesn't directly support environment variables, you can add your --sandbox_add_mount_pair via this mechanism. For example, you could even generate a new .bazelrc like:

tools/bazel file:

#!/bin/bash

root_path="$(realpath $(dirname $0)/../)" # getting the root path of your repository as we're in the `tools` folder now
GENERATED_BAZELRC=${root_path}/.generated.bazelrc

echo "build --sandbox_add_mount_pair=${HOME}/.netrc:<path_inside_the_sandbox>" >${GENERATED_BAZELRC}

${BAZEL_REAL} $@

And your main .bazelrc file should have this at the end:
import %workspace%/.generated.bazelrc

[bd-tkoolen]

I guess that works, yeah. Would be nice not to have to rely on external tools for this, but we are already using bazelisk anyway.