luarocks
diff --git a/‎.github/workflows/spec.yml‎
Lines changed: 3 additions & 1 deletion b/‎.github/workflows/spec.yml‎
Lines changed: 3 additions & 1 deletion
diff --git a/‎Dockerfile.test‎
Lines changed: 3 additions & 0 deletions b/‎Dockerfile.test‎
Lines changed: 3 additions & 0 deletions
diff --git a/‎spec/helpers/rockspec_eval_spec.moon‎
Lines changed: 92 additions & 24 deletions b/‎spec/helpers/rockspec_eval_spec.moon‎
Lines changed: 92 additions & 24 deletions
@@ -15,4 +15,6 @@ jobs:
 
     - name: test
       run: |
-        docker run luarocks-test
+        # bubblewrap needs to create namespaces, REQUIRE_SANDBOX fails the
+        # sandbox specs instead of skipping them when it can't
+        docker run --cap-add SYS_ADMIN --security-opt seccomp=unconfined --security-opt apparmor=unconfined -e REQUIRE_SANDBOX=1 luarocks-test
@@ -1,6 +1,9 @@
 FROM ghcr.io/leafo/lapis-archlinux-itchio:2026-04-23
 MAINTAINER leaf corcoran <leafot@gmail.com>
 
+# TODO: this will break once the base image is too out of date from the archlinux repo
+RUN pacman -Sy --noconfirm bubblewrap
+
 WORKDIR /site/luarocks.org
 ADD . .
 ENTRYPOINT ./ci.sh
@@ -1,14 +1,45 @@
 config = require("lapis.config").get!
 
 import eval_rockspec, run_sandboxed, get_sandbox_source, decode_result from require "helpers.rockspec_eval"
+import shell_escape from require "lapis.cmd.path"
+
+RESTY = "/usr/local/openresty/bin/resty"
 
 -- busted may run on PUC Lua, but the sandbox always runs on LuaJIT
 bytecode = string.dump -> 1
 
+local bwrap_available
 can_bwrap = ->
-  return false unless io.open "/usr/bin/bwrap"
-  status = os.execute "unshare -Ur true > /dev/null 2>&1"
-  status == 0 or status == true
+  if bwrap_available == nil
+    status = io.open("/usr/bin/bwrap") and os.execute "unshare -Ur true > /dev/null 2>&1"
+    bwrap_available = status == 0 or status == true
+  bwrap_available
+
+-- CI sets REQUIRE_SANDBOX so a missing dependency fails the build instead of
+-- quietly skipping the specs that cover production's configuration
+skip = (reason) ->
+  assert not os.getenv("REQUIRE_SANDBOX"), reason
+  pending reason
+
+bwrap_it = (name, fn) ->
+  it name, ->
+    return skip "bubblewrap is unavailable" unless can_bwrap!
+    fn!
+
+-- Runs lua with resty, where the child is run with ngx.pipe like it is in
+-- the web server. Returns everything it printed
+run_resty = (lua) ->
+  f = assert io.popen "LAPIS_ENVIRONMENT=test #{RESTY} -I . -e '#{shell_escape lua}' 2>&1"
+  with f\read "*a"
+    f\close!
+
+resty_eval = (rockspec) ->
+  run_resty string.format [[
+    local config = require("lapis.config").get()
+    config.rockspec_sandbox = { bwrap = true }
+    local spec, err = require("helpers.rockspec_eval").eval_rockspec(%q)
+    io.write("result: ", tostring(spec and spec.package), " ", tostring(err))
+  ]], rockspec
 
 describe "helpers.rockspec_eval", ->
   local original
@@ -80,18 +111,7 @@ describe "helpers.rockspec_eval", ->
       assert.falsy spec
       assert.same "Failed to eval rockspec", err
 
-  describe "in process", ->
-    before_each ->
-      config.rockspec_sandbox = nil
-
-    data_tests!
-
-  describe "child process", ->
-    before_each ->
-      config.rockspec_sandbox = {}
-
-    data_tests!
-
+  limit_tests = (it) ->
     it "kills a backtracking pattern", ->
       spec, err = eval_rockspec [[x = ("a"):rep(30000):find(".-.-.-.-b")]]
       assert.falsy spec
@@ -107,6 +127,19 @@ describe "helpers.rockspec_eval", ->
       assert.falsy spec
       assert.same "Failed to eval rockspec", err
 
+  describe "in process", ->
+    before_each ->
+      config.rockspec_sandbox = nil
+
+    data_tests!
+
+  describe "child process", ->
+    before_each ->
+      config.rockspec_sandbox = {}
+
+    data_tests!
+    limit_tests it
+
     it "reports a sandbox that can't start", ->
       config.rockspec_sandbox = { luajit: "/nonexistent" }
       spec, err = eval_rockspec [[package = "my-module"]]
@@ -156,23 +189,58 @@ describe "helpers.rockspec_eval", ->
     before_each ->
       config.rockspec_sandbox = { bwrap: true }
 
-    it "evaluates a rockspec", ->
-      unless can_bwrap!
-        pending "bubblewrap is unavailable"
-        return
-
+    bwrap_it "evaluates a rockspec", ->
       spec = assert eval_rockspec [[package = "my-module"]]
       assert.same { package: "my-module" }, spec
 
-    it "hides the site's files", ->
-      unless can_bwrap!
-        pending "bubblewrap is unavailable"
-        return
+    limit_tests bwrap_it
 
+    bwrap_it "hides the site's files", ->
       site_config = "#{io.popen("pwd")\read "*l"}/config.moon"
       assert io.open site_config
 
       out = run_sandboxed string.format([[
         io.write(tostring(io.open(%q) ~= nil), " ", tostring(io.open("/etc/passwd") ~= nil))
       ]], site_config), ""
       assert.same "false false", out
+
+    bwrap_it "has no network", ->
+      -- a udp connect to 1.1.1.1:53 sends nothing, it only needs a route
+      out = run_sandboxed [[
+        local ffi = require("ffi")
+        ffi.cdef("int socket(int domain, int type, int protocol); int connect(int fd, const void *addr, unsigned int len);")
+        local addr = ffi.new("uint8_t[16]", {2, 0, 0, 53, 1, 1, 1, 1})
+        io.write(tostring(ffi.C.connect(ffi.C.socket(2, 2, 0), addr, 16)))
+      ]], ""
+      assert.same "-1", out
+
+  describe "inside nginx", ->
+    resty_it = (name, fn) ->
+      it name, ->
+        return skip "resty is unavailable" unless io.open RESTY
+        fn!
+
+    resty_it "evaluates a rockspec under bubblewrap", ->
+      return skip "bubblewrap is unavailable" unless can_bwrap!
+      out = resty_eval [[package = "my-module"]]
+      assert.truthy out\find("result: my-module nil", 1, true), out
+
+    resty_it "kills a backtracking pattern under bubblewrap", ->
+      return skip "bubblewrap is unavailable" unless can_bwrap!
+      out = resty_eval [[x = ("a"):rep(30000):find(".-.-.-.-b")]]
+      assert.truthy out\find("result: nil Failed to eval rockspec", 1, true), out
+
+    resty_it "applies the timeout to the whole run", ->
+      -- each write restarts a per operation timeout, but not the deadline
+      out = run_resty [[
+        local config = require("lapis.config").get()
+        local out, err = require("helpers.rockspec_eval").run_sandboxed([=[
+          for i = 1, 20 do
+            os.execute("/usr/bin/sleep 0.3")
+            io.write("a")
+            io.stdout:flush()
+          end
+        ]=], "", { timeout = 1 })
+        io.write("result: ", tostring(err))
+      ]]
+      assert.truthy out\find("result: timeout", 1, true), out