give read-only access to /dev for ffmpeg to access /dev/urandom (#3109)

2024-07-16 12:32:48 +00:00 · 2024-07-16 12:32:48 +00:00 · 401098191b
parent de45c0be60
commit 401098191b
1 changed files with 2 additions and 1 deletions
--- a/internal/media/ffmpeg.go
+++ b/internal/media/ffmpeg.go
@ -119,7 +119,8 @@ func ffmpeg(ctx context.Context, dirpath string, args ...string) error {
 		Stderr: &stderr,
 		Args:   args,
 		Config: func(modcfg wazero.ModuleConfig) wazero.ModuleConfig {
-			fscfg := wazero.NewFSConfig()
+			fscfg := wazero.NewFSConfig() // needs /dev/urandom
+			fscfg = fscfg.WithReadOnlyDirMount("/dev", "/dev")
 			fscfg = fscfg.WithDirMount(dirpath, dirpath)
 			modcfg = modcfg.WithFSConfig(fscfg)
 			return modcfg