test(e2e): stabilize branch checks

Author: drew

e2e/python/test_sandbox_policy.py

@@ -30,10 +30,11 @@
 # Standard proxy address inside the sandbox network namespace
 _PROXY_HOST = "10.200.0.1"
 _PROXY_PORT = 3128
-# sslip.io keeps the wildcard test on deterministic public DNS. Vendor-owned
-# telemetry subdomains can be NXDOMAIN or resolve to private ranges in CI.
-_PUBLIC_WILDCARD_SUFFIX = "1.1.1.1.sslip.io"
+# example.com keeps the wildcard test on public DNS while avoiding sslip.io
+# rewrites that can resolve to internal ranges in CI.
+_PUBLIC_WILDCARD_SUFFIX = "example.com"
 _PUBLIC_WILDCARD_PATTERN = f"*.{_PUBLIC_WILDCARD_SUFFIX}"
+_PUBLIC_WILDCARD_SUBDOMAIN = f"www.{_PUBLIC_WILDCARD_SUFFIX}"
 
 
 def _base_policy(
@@ -1865,19 +1866,13 @@ def test_host_wildcard_matches_subdomain(
     )
     spec = datamodel_pb2.SandboxSpec(policy=policy)
     with sandbox(spec=spec, delete_on_exit=True) as sb:
-        first_subdomain = f"alpha.{_PUBLIC_WILDCARD_SUFFIX}"
-        result = sb.exec_python(_proxy_connect(), args=(first_subdomain, 443))
-        assert result.exit_code == 0, result.stderr
-        assert "200" in result.stdout, (
-            f"{_PUBLIC_WILDCARD_PATTERN} should match {first_subdomain}: "
-            f"{result.stdout}"
+        result = sb.exec_python(
+            _proxy_connect(), args=(_PUBLIC_WILDCARD_SUBDOMAIN, 443)
         )
-
-        second_subdomain = f"beta.{_PUBLIC_WILDCARD_SUFFIX}"
-        result = sb.exec_python(_proxy_connect(), args=(second_subdomain, 443))
         assert result.exit_code == 0, result.stderr
         assert "200" in result.stdout, (
-            f"{_PUBLIC_WILDCARD_PATTERN} should match {second_subdomain}: "
+            f"{_PUBLIC_WILDCARD_PATTERN} should match "
+            f"{_PUBLIC_WILDCARD_SUBDOMAIN}: "
             f"{result.stdout}"
         )
 

e2e/rust/tests/driver_config_volume.rs

@@ -6,7 +6,7 @@
 use std::fs;
 use std::io::Write;
 use std::os::unix::fs::PermissionsExt;
-use std::path::PathBuf;
+use std::path::{Path, PathBuf};
 use std::time::{SystemTime, UNIX_EPOCH};
 
 use bollard::Docker;
@@ -121,9 +121,10 @@ async fn sandbox_mounts_enabled_driver_config_bind() {
     fs::set_permissions(&input_path, fs::Permissions::from_mode(0o666))
         .expect("make bind mount input readable by sandbox user");
 
+    let bind_source = bind_mount_source_path(&driver, host_dir.path());
     let bind_mount = serde_json::json!({
         "type": "bind",
-        "source": host_dir.path(),
+        "source": bind_source,
         "target": BIND_TARGET,
         "read_only": false
     });
@@ -427,3 +428,21 @@ fn driver_config_mount_json(driver: &str, mount: &Value) -> String {
     );
     Value::Object(root).to_string()
 }
+
+fn bind_mount_source_path(driver: &str, path: &Path) -> PathBuf {
+    if driver == "docker" {
+        github_actions_host_work_path(path).unwrap_or_else(|| path.to_path_buf())
+    } else {
+        path.to_path_buf()
+    }
+}
+
+fn github_actions_host_work_path(path: &Path) -> Option<PathBuf> {
+    if std::env::var("GITHUB_ACTIONS").ok().as_deref() != Some("true") {
+        return None;
+    }
+
+    let relative = path.strip_prefix("/__w").ok()?;
+    let mapped = Path::new("/home/runner/_work").join(relative);
+    mapped.exists().then_some(mapped)
+}