[RFC] Shared Build Sandboxes

This RFC is created in the context of package management, but the proposal here could be used to address issues such as https://github.com/ocaml/dune/issues/6005 as well.

Problem

When using dune as a package manager, our goal is to build opam packages with dune. This is easy enough to do in a dune workspace, we just pick a special directory and build all the packages there. The problem is evident when we try to share built packages between workspaces. Would like to share these artifacts by using the dune cache and not creating our own ad-hoc caching mechanism. Unfortunately, this isn't possible because all workspace local rules leak the path of dune workspace itself, which makes all the package artifacts non-reusable.

Solution

To solve this problem, all that we really need is a way to setup the package build rules in a way that they produce the same paths no matter where the workspace is from.

We have a mechanism that allows us to relocate executing actions to directories already, it's called sandboxing. All that we need to do is to prepare sandbox paths that are shareable across all workspaces. Consider the following scheme:

1. We maintain all sandboxes in a single directory: $HOME/.dune/sandboxes/<hash>
2. The hash is the digest of the action and its dependencies. This is so that no matter what dune instance is used to build the package, it will have the same hash if it's building the same package.
3. Before building anything in the sandbox, we acquire a file lock inside this sandbox.
4. If we succeed acquiring the lock, we execute the action and populate the dune cache. Then we release the lock.
5. If we don't acquire the lock, we can just wait until we get the lock and then check if it was written to the cache. If it wasn't, the action must have failed and we'll re-run to see the failure.

Alternatives

chroot

Although it's somewhat portable, it's dismissed because it requires elevated privileges

cgroups

Using cgroups (or any of its API wrappers such as bubblewrap) works very well on Linux, but it's not portable enough.

Start with the RFC's Problem and Solution sections, then review the Alternatives section for the portability constraints. The proposal describes shared, locked sandboxes that produce reusable cache artifacts; done would require a concrete design and implementation plan, but no files or tests are identified here.