--run commands in a sandbox

[cxrvh]

Closes: #348

[rh-atomic-bot]

Can one of the admins verify this patch?
I understand the following commands:

• bot, add author to whitelist
• bot, test pull request
• bot, test pull request once

[bbhtt]

imo, the thing to fix here is flatpak-build I'm not sure if I have found a reason as to why it gives access to home by default.

See flatpak/flatpak#6231

[cxrvh]

I think I was following all other commands which explicitly add --nofilesystem=host (I guess it should now be --nofilesystem=host:reset).

Quick search & I haven't checked if it's really the correct line, but I guess host access was explicitly added:
flatpak/flatpak@3a20c07
https://github.com/flatpak/flatpak/blob/5eea3304146964ccf044d6c76e872b3c333a1112/app/flatpak-builtins-build.c#L439

[swick]

I could certainly remove the special casing in flatpak build. The question really is if it breaks things.

[swick]

FWIW, I opened a PR for flatpak: flatpak/flatpak#6308

[bbhtt]

I think we would want this PR too along with the Flatpak change. Latest Flatpak builder can be run against an old version of Flatpak.

As this is backwards incompatible change, probably whenever 1.5.0 starts

[bbhtt]

the subject should be something like manifest: Disable all filesystem access in flatpak-builder --run sandbox