Gradle crashes when FileLockCommunicator cannot open a DatagramSocket despite --offline flag #25762
Comments
|
Thank you for your interest in Gradle! This issue needs a decision from the team responsible for that area. They have been informed. Response time may vary. The system uses file sockets which are required to communicate even in a single-daemon environment. As far as I know, workers use it for communicating around locked resources. |
ov7a
added
in:daemon
a:feature
|
Would something like is mentioned here work for you? ocaml/opam#5221 (comment) Gradle uses network-based IPC to communicate to workers (like compiler daemons for Kotlin or Java) or tests, so there needs to be some way to communicate back to the Gradle daemon. |
|
Given that there is no reply, I assume that this issue can be closed. It may be reopened later if we receive more use cases and details. |
ov7a
added
closed:not-fixed
|
No, the process sandboxing cannot be altered, as it is part of a secure build system. When gradle is run with "--offline", then network access should not be attempted. The fact that it does is clearly a bug. |
ov7a
added
👋 team-triage
|
Sorry for the long delay in responding. This works as designed, as the goal of That said, you have a valid use case that Gradle could support. Doing so would require significant work, as we'd need to replace our current IP-based cross-process communication with other means on all the supported platforms. As the feature at hand does not fall into our current priorities, I don't expect us to work on this on the foreseeable future. If you believe this is important for Gradle to support, a few ways you can help make it happen would be:
|
ov7a
added
closed:not-fixed
Expected Behavior
Gradle should be able to run offline and in network-restricted environments, but despite the
--offlineflag, it still attempts to start a datagram server. This should be disabled when the--offlineflags is specified and the daemon is not being used. Or there should be some other option or environment variable to prevent theFileLockCommunicatorfrom being used in isolated environments.Current Behavior
Any build where the process cannot open a datagram socket will fail, even when the daemon is disabled. This can be reproduced on macOS by running the gradle process with the
sandbox-exectool configured to deny thenetwork-inboundpermission:Context (optional)
This issue prevents us from using Gradle in a secure network-constrained environment. When "--offline" is specified, it should really be offline.
Note that if you swap the permissions (i.e.,
(deny network-outbound)and(allow network-inbound)), then the build does complete successfully (provided that all the project's network dependencies are downloaded and available). So while it is possible to run Gradle without requesting anything from the network, it cannot be run without being able to listen on a port.Steps to Reproduce
macOS 13.4.1, Homebrew, openjdk version "20.0.1" 2023-04-18
--no-daemonflag. E.g.:export GRADLE_OPTS="-Dorg.gradle.daemon=false -Xmx2048m"gradle init --type kotlin-library --dsl kotlin --console plain --no-daemon --offline --project-name=ExampleDemo --package=example.demo --test-framework=kotlintestGradle version
8.2.1
Build scan URL (optional)
No response
Your Environment (optional)
No response
The text was updated successfully, but these errors were encountered: