From 6d78e406f4172177a7eacffd818256fb34c8a21c Mon Sep 17 00:00:00 2001 From: JeongCheolLee Date: Mon, 26 Oct 2026 15:19:14 +0900 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=A4=20fix:=20Mount=20Font=20And=20Libr?= =?UTF-8?q?eOffice=20Configuration=20Into=20NsJail?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The jail's /etc contains only ld.so.cache and a static hosts file. Debian's LibreOffice resolves share/registry/main.xcd through a symlink into /etc/libreoffice, so soffice aborts with uno::RuntimeException about 0.1 s after start when the link dangles, and fontconfig finds no configuration without /etc/fonts. Bind both directories read-only and non-mandatory, matching the existing ld.so.cache mount. Images that do not ship these packages are unaffected. --- api/config/sandbox.cfg | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/api/config/sandbox.cfg b/api/config/sandbox.cfg index b9f7ce60..5e64c247 100644 --- a/api/config/sandbox.cfg +++ b/api/config/sandbox.cfg @@ -52,6 +52,28 @@ mount { mandatory: false } +# Read-only configuration for native document tools. fontconfig loads its +# configuration from /etc/fonts, so font matching inside the jail has no +# configuration without it. Debian's LibreOffice ships +# /usr/lib/libreoffice/share/registry/main.xcd as a symlink into +# /etc/libreoffice and aborts at startup when that link dangles. Neither path +# holds executables or secrets; both are optional for images without them. +mount { + src: "/etc/fonts" + dst: "/etc/fonts" + is_bind: true + rw: false + mandatory: false +} + +mount { + src: "/etc/libreoffice" + dst: "/etc/libreoffice" + is_bind: true + rw: false + mandatory: false +} + # Static /etc/hosts so "localhost" resolves for tool-call-server connections. # Uses inline content instead of bind-mounting the host's /etc/hosts, which # in Kubernetes leaks pod name, internal IP, and deployment metadata.