[sylvestre]

Toolchains and inputs are packaged on the client and routinely contain absolute symlinks. Inside bubblewrap those resolve within the toolchain, but the overlay builder unpacks the archives, creates the cwd and output directories and reads the outputs back from the build server's own root directory, so the same paths could resolve to something else there than what the compiler saw. join_suffix also keeps .. components, so output paths going above / were not clamped the way they are in the sandbox.

Add run_in_root(), which runs a closure on a scoped thread after unshare(CLONE_FS) and chroot() into the unpack directory, and use it for the toolchain unpack, the inputs unpack and directory creation, and the output retrieval, so they all see the same tree as the sandboxed command. The chroot only affects that thread and ends with it.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 3.60360% with 107 lines in your changes missing coverage. Please review.
✅ Project coverage is 77.88%. Comparing base (7bdb9bd) to head (ba12b43).

Files with missing lines	Patch %	Lines
src/bin/sccache-dist/build.rs	3.60%	107 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2908      +/-   ##
==========================================
- Coverage   78.00%   77.88%   -0.13%     
==========================================
  Files          73       73              
  Lines       43136    43209      +73     
==========================================
+ Hits        33650    33652       +2     
- Misses       9486     9557      +71     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.