diff --git a/CHANGELOG.md b/CHANGELOG.md
index 534d181..5bb099f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,27 @@ See the fragment files in the [changelog.d/ directory](./changelog.d).
+
+## 22.0.0 — 2026-08-12
+
+### Added
+
+- Support for the Verawood release.
+
+### Changed
+
+- The default AppArmor Profile now requires AppArmor 4, which available on
+ ubuntu 24.04 or newer.
+- AppArmor enforcement is now a requirement and can not be turned off.
+- The container name and internal services for kubernetes and docker was changed
+ from `codejailservice` to `codejail`.
+
+### Removed
+
+- Support for the old remote service implementation of codejail service
+ ([codejailservice](https://github.com/edunext/codejailservice.git)] has been
+ dropped.
+
## 21.0.1 — 2026-05-08
@@ -25,7 +46,7 @@ See the fragment files in the [changelog.d/ directory](./changelog.d).
## 21.0.0 - 2025-11-04
- feat!: add support for the Ulmo release
-
+
This changes also include support for openedx/codejail-service as an
alternative implementation of the safe_exec REST API.
@@ -44,14 +65,14 @@ See the fragment files in the [changelog.d/ directory](./changelog.d).
appropriate labels.
- feat: use an "init service" to load the apparmor profile (#63)
-
+
This follows the same logic as the "permissions" service used by tutor
core. The `codejail-apparmor-loader` service runs the command used
previously by the init job.
-
+
It makes more sense to handling loading of the apparmor profile with an
init service:
-
+
- The profile is ephemeral, rebooting the host will require to load it
again.
- The profile is a dependency for the container to start. Things like
@@ -147,7 +168,7 @@ See the fragment files in the [changelog.d/ directory](./changelog.d).
- Add support for Olive release (#28).
- Adds mantainer group.
-## 14.1.0 - 2022-09-26
+## 14.1.0 - 2022-09-26
### Added
@@ -163,14 +184,14 @@ See the fragment files in the [changelog.d/ directory](./changelog.d).
- Bump version according tutor practices for Nutmeg release.
-## 13.0.0 - 2022-05-02
+## 13.0.0 - 2022-05-02
### Added
- Add repo documentation.
- Bump version according tutor practices for Maple release.
-## 12.0.2 - 2022-04-29
+## 12.0.2 - 2022-04-29
### Added
diff --git a/README.md b/README.md
index 41d778b..884ba93 100644
--- a/README.md
+++ b/README.md
@@ -7,17 +7,6 @@ This plugin configures and runs a remote CodeJail Service instance that
implements the safe-exec API used by the Open edX platform to offer more
advanced capabilities to course authors.
-Starting from the Ulmo release, the codejail plugin is transitioning to an
-alternative implementation of the safe-exec API (
-[Codejail Service V2](https://github.com/openedx/codejail-service)). You can
-opt-in to use this new implementation on Ulmo before it finally becomes the
-default on the Verawood release.
-
-> [!NOTE]
-> The new CodeJail Service implementation is based on Django instead of Flask,
-> therefore settings changed with the `codejail-*-settings` patches must be
-> adjusted accordingly.
-
## Installation
To install the latest version, run:
@@ -47,38 +36,35 @@ aa-enabled
To customize the configuration, update the following settings in Tutor:
- `CODEJAIL_APPARMOR_DOCKER_IMAGE`: (default: `docker.io/ednxops/codejail_apparmor_loader:latest`)
-- `CODEJAIL_DOCKER_IMAGE_V2` : (default: `{{ CODEJAIL_DOCKER_IMAGE }}-v2`)
- `CODEJAIL_DOCKER_IMAGE`: (default: `docker.io/ednxops/codejailservice:{{__version__}}`)
- `CODEJAIL_ENABLE_K8S_DAEMONSET` (default: `False`)
-- `CODEJAIL_ENFORCE_APPARMOR` (default: `True`)
- `CODEJAIL_EXTRA_PIP_REQUIREMENTS` (default: `[]`)
-- `CODEJAIL_SANDBOX_PYTHON_VERSION` (default: `3.11.9`)
-- `CODEJAIL_SERVICE_REPOSITORY` (default: `https://github.com/edunext/codejailservice.git`\`)
+- `CODEJAIL_SANDBOX_PYTHON_VERSION` (default: `3.12`)
+- `CODEJAIL_SERVICE_REPOSITORY` (default: `https://github.com/openedx/codejail-service.git`)
- `CODEJAIL_SERVICE_VERSION` (default: `{{ OPENEDX_COMMON_VERSION }}`),
-- `CODEJAIL_SERVICE_V2_REPOSITORY`: (default: `https://github.com/openedx/codejail-service.git`)
-- `CODEJAIL_SERVICE_V2_VERSION`: (default: `{{ OPENEDX_COMMON_VERSION }}`)
-- `CODEJAIL_USE_SERVICE_V2`: (default: `False`)
-
-The `CODEJAIL_*_SERVICE_V2` settings are meant to be used only during the Ulmo
-release and will be phased-out during the Verawood release.
-
-To opt-in to the new implementation of the code-exec API set
-`CODEJAIL_USE_SERVICE_V2` to `True` and re-deploy your environment. If you are
-using a a custom image for the codejail service you will need to rebuild
-it with `CODEJAIL_USE_SERVICE_V2` set to `True`.
### Custom Image
In most cases, you can work with the provided Docker image for the
-release. You will need to build a custom image if you either:
-
-- Need additional packages installed in the sandbox environment. Use the setting
- `CODEJAIL_EXTRA_PIP_REQUIREMENTS` to define the list of additional packages.
-- Need to run the sandbox environment under a different Python version. The
- default Python version of the sandbox might get updated between releases,
- potentially breaking instructor generated code. You can set
- `CODEJAIL_SANDBOX_PYTHON_VERSION` to an older version to avoid disruption
- while figuring out a migration plan.
+release. However, there might be cases when a custom image will be necessary:
+
+- If you need additional packages installed in the sandbox environment. Use the
+ setting `CODEJAIL_EXTRA_PIP_REQUIREMENTS` to define the list of additional
+ packages.
+- If you need to run the sandbox environment under a different Python version
+ you can use `CODEJAIL_SANDBOX_PYTHON_VERSION`. This is particularly useful
+ when the sandbox version is upgraded between releases but you need to figure
+ out a migration plan for instructor code.
+- If you need a completely different set of packages in the sandbox virtual
+ environment. In this case you will need to point to a requirements file using
+ the following docker build arguments: `SANDBOX_DEPS_REPO`,
+ `SANDBOX_DEPS_VERSION`, `SANDBOX_DEPS_SRC_DIR` and `SANDBOX_DEPS_SRC_FILE`.
+ Their current default values are
+ `https://github.com/openedx/codejail-service.git`, `{{ OPENEDX_COMMON_VERSION
+ }}`, `requirements/sandbox` and `base.txt`. This will point to
+ https://github.com/openedx/codejail-service/blob/release/verawood.1/requirements/base.txt
+ for the Verawood release. You can provide the arguments to Tutor as follows
+ `tutor images build codejail -a SANDBOX_DEPS_VERSION=ulmo2`.
## Kubernetes Support
@@ -94,10 +80,6 @@ and has successfully loaded the profile.
You can enable a helper Daemon Set that will load the profile onto all the nodes
by setting `CODEJAIL_ENABLE_K8S_DAEMONSET` to true.
-If you choose to run the service without enforcing the AppArmor profile
-(absolutely discouraged, and not possible on the newer implementation of
-codejail-service), you can set `CODEJAIL_ENFORCE_APPARMOR` to `False`.
-
More info about this discussion can be found on [this
issue](https://github.com/eduNEXT/tutor-contrib-codejail/issues/24).
@@ -117,8 +99,24 @@ width="725px"}
In this case, the section\'s content will render correctly and work as
specified in the instructions of the problem.
+## New CodeJail Service implementation
+
+The Ulmo release introduced support for deploying a new
+implementation of the remote CodeJail service (openedx/codejail-service). The
+Verawood release completely removes support for deploying the old version of the
+service (edunext/codejailservice). Users should be mindful of the following
+points when upgrading:
+
+1. The new CodeJail service **requires** AppArmor 4 on the host machine.
+ AppArmor 4 is available on relatively new Debian based distributions (ubuntu
+ 24.04, Debian Trixie, etc).
+2. AppArmor enforcement is no longer optional. The new CodeJail service performs
+ startup checks to ensure the sandbox is properly isolated and will not start
+ if the AppArmor profile is not loaded and configured.
+3. The new CodeJail service implementation is based on Django instead of Flask.
+ Any usage of the `codejail-*-settings` must be adjusted accordingly.
+
## License
This software is licensed under the terms of the AGPLv3. See the LICENSE
file for details.
-
diff --git a/pyproject.toml b/pyproject.toml
index 86f94c6..3a85430 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
[project]
name = "tutor-contrib-codejail"
-version = "21.0.1"
+version = "22.0.0"
description = "Codejail plugin for Tutor"
readme = "README.md"
license-files = ["LICENSE"]
@@ -9,7 +9,7 @@ authors = [
]
requires-python = ">=3.10"
dependencies = [
- "tutor~=21.0"
+ "tutor~=22.0"
]
classifiers = [
"Development Status :: 3 - Alpha",
diff --git a/tutorcodejail/patches/cms-env b/tutorcodejail/patches/cms-env
index 10a52f8..4c8b040 100644
--- a/tutorcodejail/patches/cms-env
+++ b/tutorcodejail/patches/cms-env
@@ -1,4 +1,4 @@
ENABLE_CODEJAIL_REST_SERVICE: true
-CODE_JAIL_REST_SERVICE_HOST: "http://{{ CODEJAIL_HOST }}:8550"
+CODE_JAIL_REST_SERVICE_HOST: "http://codejail:8000"
CODE_JAIL_REST_SERVICE_CONNECT_TIMEOUT: 0.5
CODE_JAIL_REST_SERVICE_READ_TIMEOUT: 3.5
diff --git a/tutorcodejail/patches/k8s-deployments b/tutorcodejail/patches/k8s-deployments
index f22d9e5..f9dec16 100644
--- a/tutorcodejail/patches/k8s-deployments
+++ b/tutorcodejail/patches/k8s-deployments
@@ -1,27 +1,26 @@
---
-{% if CODEJAIL_USE_SERVICE_V2 %}
apiVersion: apps/v1
kind: Deployment
metadata:
- name: codejailservice
+ name: codejail
labels:
- app.kubernetes.io/name: codejailservice
+ app.kubernetes.io/name: codejail
spec:
selector:
matchLabels:
- app.kubernetes.io/name: codejailservice
+ app.kubernetes.io/name: codejail
template:
metadata:
labels:
- app.kubernetes.io/name: codejailservice
+ app.kubernetes.io/name: codejail
spec:
securityContext:
appArmorProfile:
type: Localhost
localhostProfile: openedx_codejail_service
containers:
- - name: codejailservice
- image: {{ CODEJAIL_DOCKER_IMAGE_V2 }}
+ - name: codejail
+ image: {{ CODEJAIL_DOCKER_IMAGE }}
ports:
- containerPort: 8550
env:
@@ -35,45 +34,6 @@ spec:
- name: settings-codejail
configMap:
name: settings-codejail
-{% else %}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
- name: codejailservice
- labels:
- app.kubernetes.io/name: codejailservice
-spec:
- selector:
- matchLabels:
- app.kubernetes.io/name: codejailservice
- template:
- metadata:
- labels:
- app.kubernetes.io/name: codejailservice
- spec:
- {% if CODEJAIL_ENFORCE_APPARMOR %}
- securityContext:
- appArmorProfile:
- type: Localhost
- localhostProfile: docker-edx-sandbox
- {% endif %}
- containers:
- - name: codejailservice
- image: {{ CODEJAIL_DOCKER_IMAGE }}
- ports:
- - containerPort: 8550
- env:
- - name: FLASK_APP_SETTINGS
- value: codejailservice.tutor.ProductionConfig
- volumeMounts:
- - mountPath: /openedx/codejailservice/codejailservice/tutor.py
- name: settings-codejail
- subPath: tutor.py
- volumes:
- - name: settings-codejail
- configMap:
- name: settings-codejail
-{% endif %}
{% if CODEJAIL_ENABLE_K8S_DAEMONSET %}
---
apiVersion: apps/v1
diff --git a/tutorcodejail/patches/k8s-services b/tutorcodejail/patches/k8s-services
index 7b259c1..49736e2 100644
--- a/tutorcodejail/patches/k8s-services
+++ b/tutorcodejail/patches/k8s-services
@@ -2,13 +2,14 @@
apiVersion: v1
kind: Service
metadata:
- name: codejailservice
+ name: codejail
labels:
- app.kubernetes.io/name: codejailservice
+ app.kubernetes.io/name: codejail
spec:
type: ClusterIP
ports:
- - port: 8550
+ - port: 8000
protocol: TCP
+ name: http
selector:
- app.kubernetes.io/name: codejailservice
+ app.kubernetes.io/name: codejail
diff --git a/tutorcodejail/patches/kustomization-configmapgenerator b/tutorcodejail/patches/kustomization-configmapgenerator
index e1adba7..f232d94 100644
--- a/tutorcodejail/patches/kustomization-configmapgenerator
+++ b/tutorcodejail/patches/kustomization-configmapgenerator
@@ -1,17 +1,12 @@
- name: codejail-profile
files:
- - plugins/codejail/apps/profiles/docker-edx-sandbox.profile
- plugins/codejail/apps/profiles/openedx-codejail-service.profile
options:
labels:
app.kubernetes.io/name: codejail-aa-loader
-- name: settings-codejail
+- name: codejail-settings
files:
- {% if CODEJAIL_USE_SERVICE_V2 %}
- - plugins/codejail/apps/codejail-service-v2/tutor.py
- {% else %}
- plugins/codejail/apps/codejail/tutor.py
- {% endif %}
options:
labels:
- app.kubernetes.io/name: codejailservice
+ app.kubernetes.io/name: codejail
diff --git a/tutorcodejail/patches/lms-env b/tutorcodejail/patches/lms-env
index 10a52f8..4c8b040 100644
--- a/tutorcodejail/patches/lms-env
+++ b/tutorcodejail/patches/lms-env
@@ -1,4 +1,4 @@
ENABLE_CODEJAIL_REST_SERVICE: true
-CODE_JAIL_REST_SERVICE_HOST: "http://{{ CODEJAIL_HOST }}:8550"
+CODE_JAIL_REST_SERVICE_HOST: "http://codejail:8000"
CODE_JAIL_REST_SERVICE_CONNECT_TIMEOUT: 0.5
CODE_JAIL_REST_SERVICE_READ_TIMEOUT: 3.5
diff --git a/tutorcodejail/patches/local-docker-compose-dev-services b/tutorcodejail/patches/local-docker-compose-dev-services
index b092da1..e69de29 100644
--- a/tutorcodejail/patches/local-docker-compose-dev-services
+++ b/tutorcodejail/patches/local-docker-compose-dev-services
@@ -1,8 +0,0 @@
-codejailservice:
- command: flask run --host 0.0.0.0 --port 8550
- environment:
- FLASK_ENV: development
- FLASK_APP_SETTINGS: codejailservice.tutor.DevelopmentConfig
- ports:
- - "8550:8550"
- restart: unless-stopped
diff --git a/tutorcodejail/patches/local-docker-compose-services b/tutorcodejail/patches/local-docker-compose-services
index a40ad88..e101e83 100644
--- a/tutorcodejail/patches/local-docker-compose-services
+++ b/tutorcodejail/patches/local-docker-compose-services
@@ -1,35 +1,16 @@
#############Codejail service
-{% if CODEJAIL_USE_SERVICE_V2 %}
-codejailservice:
- image: {{ CODEJAIL_DOCKER_IMAGE_V2 }}
- ports:
- - 8550:8550
+codejail:
+ image: {{ CODEJAIL_DOCKER_IMAGE }}
environment:
DJANGO_SETTINGS_MODULE: codejail_service.settings.tutor
security_opt:
- apparmor:openedx_codejail_service
volumes:
- - ../plugins/codejail/apps/codejail-service-v2/tutor.py:/app/codejail_service/settings/tutor.py:ro
- restart: unless-stopped
- depends_on:
- codejail-apparmor-loader:
- condition: service_completed_successfully
-{% else %}
-codejailservice:
- image: {{ CODEJAIL_DOCKER_IMAGE }}
- environment:
- FLASK_APP_SETTINGS: codejailservice.tutor.ProductionConfig
- {% if CODEJAIL_ENFORCE_APPARMOR %}
- security_opt:
- - apparmor:docker-edx-sandbox
- {% endif %}
- volumes:
- - ../plugins/codejail/apps/codejail/tutor.py:/openedx/codejailservice/codejailservice/tutor.py:ro
+ - ../plugins/codejail/apps/codejail/tutor.py:/app/codejail_service/settings/tutor.py:ro
restart: unless-stopped
depends_on:
codejail-apparmor-loader:
condition: service_completed_successfully
-{% endif %}
codejail-apparmor-loader:
image: {{ CODEJAIL_APPARMOR_DOCKER_IMAGE }}
diff --git a/tutorcodejail/plugin.py b/tutorcodejail/plugin.py
index 483c908..f0468be 100644
--- a/tutorcodejail/plugin.py
+++ b/tutorcodejail/plugin.py
@@ -8,7 +8,6 @@
import importlib_resources
from tutor import hooks
-from tutor.types import Config
from .__about__ import __version__
@@ -21,18 +20,13 @@
"defaults": {
"APPARMOR_DOCKER_IMAGE": "docker.io/ednxops/codejail_apparmor_loader:apparmor-4",
"DOCKER_IMAGE": f"docker.io/ednxops/codejailservice:{__version__}",
- "DOCKER_IMAGE_V2": "{{ CODEJAIL_DOCKER_IMAGE }}-v2",
"ENABLE_K8S_DAEMONSET": False,
"ENFORCE_APPARMOR": True,
"EXTRA_PIP_REQUIREMENTS": [],
- "HOST": "codejailservice",
- "SANDBOX_PYTHON_VERSION": "3.11.14",
- "SERVICE_REPOSITORY": "https://github.com/edunext/codejailservice.git",
- "SERVICE_V2_REPOSITORY": "https://github.com/openedx/codejail-service.git",
- "SERVICE_V2_VERSION": "{{ OPENEDX_COMMON_VERSION }}",
+ "SANDBOX_PYTHON_VERSION": "3.12",
+ "SERVICE_REPOSITORY": "https://github.com/openedx/codejail-service.git",
"SERVICE_VERSION": "{{ OPENEDX_COMMON_VERSION }}",
"SKIP_INIT": False,
- "USE_SERVICE_V2": False,
"VERSION": __version__,
},
"overrides": {},
@@ -71,60 +65,47 @@ def get_apparmor_abi():
]
)
+hooks.Filters.IMAGES_BUILD.add_item(
+ (
+ "codejail",
+ ("plugins", "codejail", "build", "codejail"),
+ "{{ CODEJAIL_DOCKER_IMAGE }}",
+ (),
+ ),
+)
+hooks.Filters.IMAGES_PULL.add_item(
+ (
+ "codejail",
+ "{{ CODEJAIL_DOCKER_IMAGE }}",
+ )
+)
+hooks.Filters.IMAGES_PUSH.add_item(
+ (
+ "codejail",
+ "{{ CODEJAIL_DOCKER_IMAGE }}",
+ )
+)
-@hooks.Filters.IMAGES_BUILD.add()
-def _build_codejail_images(
- images: list[tuple[str, str | tuple[str, ...], str, tuple[str, ...]]],
- tutor_config: Config,
-):
- """Choose the appropiate build context when using CODEJAIL_USE_SERVICE_V2."""
- # TODO: Remove after the Verawood update
- if tutor_config.get("CODEJAIL_USE_SERVICE_V2"):
- codejail_img = (
- "codejail",
- "plugins/codejail/build/codejail-service",
- "{{ CODEJAIL_DOCKER_IMAGE_V2 }}",
- (),
- )
- else:
- codejail_img = (
- "codejail",
- "plugins/codejail/build/codejail",
- "{{ CODEJAIL_DOCKER_IMAGE }}",
- (),
- )
- apparmor_img = (
+hooks.Filters.IMAGES_BUILD.add_item(
+ (
"codejail_apparmor",
("plugins", "codejail", "build", "codejail_apparmor"),
"{{CODEJAIL_APPARMOR_DOCKER_IMAGE}}",
(),
+ ),
+)
+hooks.Filters.IMAGES_PULL.add_item(
+ (
+ "codejail_apparmor",
+ "{{CODEJAIL_APPARMOR_DOCKER_IMAGE}}",
)
-
- return images + [codejail_img, apparmor_img]
-
-
-@hooks.Filters.IMAGES_PUSH.add()
-def _push_codejail_images(
- images: list[tuple[str, str]],
- tutor_config: Config,
-):
- """Choose the appropiate image tag when using CODEJAIL_USE_SERVICE_V2."""
- # TODO: Remove after the Verawood update
- if tutor_config.get("CODEJAIL_USE_SERVICE_V2"):
- codejail_img = (
- "codejail",
- "{{ CODEJAIL_DOCKER_IMAGE_V2 }}",
- )
- else:
- codejail_img = (
- "codejail",
- "{{ CODEJAIL_DOCKER_IMAGE }}",
- )
- apparmor_img = (
+)
+hooks.Filters.IMAGES_PUSH.add_item(
+ (
"codejail_apparmor",
"{{CODEJAIL_APPARMOR_DOCKER_IMAGE}}",
)
- return images + [codejail_img, apparmor_img]
+)
# Boilerplate code
diff --git a/tutorcodejail/templates/codejail/apps/codejail-service-v2/tutor.py b/tutorcodejail/templates/codejail/apps/codejail-service-v2/tutor.py
deleted file mode 100644
index 172a72b..0000000
--- a/tutorcodejail/templates/codejail/apps/codejail-service-v2/tutor.py
+++ /dev/null
@@ -1,34 +0,0 @@
-from codejail_service.settings.local import * # pylint: disable=wildcard-import
-
-ALLOWED_HOSTS = [
- 'codejailservice',
- 'localhost',
-]
-
-CODEJAIL_ENABLED = True
-SECRET_KEY = '{{ CODEJAIL_SECRET_KEY }}'
-
-CODE_JAIL = {
- 'python_bin': '/sandbox/venv/bin/python',
- 'user': 'sandbox',
-
- # Configurable limits.
- 'limits': {
- # CPU-seconds
- 'CPU': 3,
- # Clock seconds
- 'REALTIME': 3,
- # Need at least 300 MiB memory for matplotlib alone. 512 MiB should be
- # enough headroom in general.
- 'VMEM': 512 * 1024 * 1024,
- # 10 MB file size limit
- 'FSIZE': 10 * 1024 * 1024,
- # 15 processes and threads (codejail default)
- 'NPROC': 15,
- # Don't use a proxy process to spawn subprocesses.
- 'PROXY': 0,
- },
-}
-
-{{ patch("codejail-common-settings") }}
-{{ patch("codejail-production-settings") }}
diff --git a/tutorcodejail/templates/codejail/apps/codejail/tutor.py b/tutorcodejail/templates/codejail/apps/codejail/tutor.py
index df72ab4..592643d 100644
--- a/tutorcodejail/templates/codejail/apps/codejail/tutor.py
+++ b/tutorcodejail/templates/codejail/apps/codejail/tutor.py
@@ -1,18 +1,34 @@
-"""Module with the configuration of config classes."""
-from codejailservice.config import DevelopmentConfig, ProductionConfig
+from codejail_service.settings.local import * # pylint: disable=wildcard-import
+ALLOWED_HOSTS = [
+ 'codejail',
+ 'localhost',
+]
-class DevelopmentConfig(DevelopmentConfig):
- """Class to use for development context that inherits from DevelopmentConfig."""
+CODEJAIL_ENABLED = True
+SECRET_KEY = '{{ CODEJAIL_SECRET_KEY }}'
- CODE_JAIL = DevelopmentConfig.CODE_JAIL
- {{patch("codejail-common-settings") | indent(4)}}
- {{patch("codejail-development-settings") | indent(4)}}
+CODE_JAIL = {
+ 'python_bin': '/sandbox/venv/bin/python',
+ 'user': 'sandbox',
+ # Configurable limits.
+ 'limits': {
+ # CPU-seconds
+ 'CPU': 3,
+ # Clock seconds
+ 'REALTIME': 3,
+ # Need at least 300 MiB memory for matplotlib alone. 512 MiB should be
+ # enough headroom in general.
+ 'VMEM': 512 * 1024 * 1024,
+ # 10 MB file size limit
+ 'FSIZE': 10 * 1024 * 1024,
+ # 15 processes and threads (codejail default)
+ 'NPROC': 15,
+ # Don't use a proxy process to spawn subprocesses.
+ 'PROXY': 0,
+ },
+}
-class ProductionConfig(ProductionConfig):
- """Class to use for production context that inherits from ProductionConfig."""
-
- CODE_JAIL = ProductionConfig.CODE_JAIL
- {{patch("codejail-common-settings") | indent(4)}}
- {{patch("codejail-production-settings") | indent(4)}}
+{{ patch("codejail-common-settings") }}
+{{ patch("codejail-production-settings") }}
diff --git a/tutorcodejail/templates/codejail/build/codejail-service/Dockerfile b/tutorcodejail/templates/codejail/build/codejail-service/Dockerfile
deleted file mode 100644
index a62f8cd..0000000
--- a/tutorcodejail/templates/codejail/build/codejail-service/Dockerfile
+++ /dev/null
@@ -1,173 +0,0 @@
-FROM scratch AS codejail-service-code
-ARG CODEJAIL_SERVICE_REPO={{ CODEJAIL_SERVICE_V2_REPOSITORY }}
-ARG CODEJAIL_SERVICE_VERSION={{ CODEJAIL_SERVICE_V2_VERSION }}
-ADD ${CODEJAIL_SERVICE_REPO}#${CODEJAIL_SERVICE_VERSION} /
-
-FROM scratch AS sandbox-dependencies
-# Where to get the Python dependencies lockfile for installing
-# packages into the sandbox environment. Defaults to the codejail
-# dependencies in edx-platform.
-ARG SANDBOX_DEPS_REPO={{ EDX_PLATFORM_REPOSITORY }}
-ARG SANDBOX_DEPS_VERSION={{ CODEJAIL_SERVICE_V2_VERSION }}
-# Path to the lockfile in the deps repo, as dir + filename.
-#
-# The path base.txt will get the latest dependencies, but this needs
-# to be coordinated with SANDBOX_PY_VER as each release has a
-# different Python support window.
-ARG SANDBOX_DEPS_SRC_DIR=requirements/edx-sandbox
-ADD ${SANDBOX_DEPS_REPO}#${SANDBOX_DEPS_VERSION}:${SANDBOX_DEPS_SRC_DIR} /
-
-FROM docker.io/ubuntu:24.04 AS app
-ARG APP_PY_VER=3.12
-# See codejail-service deployment and configuration docs for why we need to select
-# a UID/GID that is unlikely to collide with anything on the host. (Short answer:
-# RLIMIT_NPROC UID-global usage pool, and Docker not isolating UIDs.)
-#
-# Selected via: python3 -c 'import random; print(random.randrange(3000, 2 ** 31))'
-ARG APP_UID=15826504
-ARG APP_GID=$APP_UID
-
-ARG SANDBOX_DEPS_SRC_FILE=base.txt
-
-# Python version for sandboxed executions. This must be coordinated with
-# `SANDBOX_DEPS_SRC_*` to ensure compatibility.
-ARG SANDBOX_PY_VER={{ '.'.join(CODEJAIL_SANDBOX_PYTHON_VERSION.split('.')[:2]) }}
-
-
-##### Base app installation #####
-
-ENV DEBIAN_FRONTEND=noninteractive
-ARG APT_INSTALL="apt-get install --quiet --yes --no-install-recommends"
-
-# The codejail library specifies a certain structure to how the sandboxing is
-# performed. (See the documentation in the codejail library README:
-# https://github.com/openedx/codejail).
-#
-# Some of this structure can be changed, and some cannot. Any changes that are
-# possible will also need to be coordinated with changes to the apparmor profile
-# as well as to the `CODE_JAIL` Django settings. Accordingly, it's best to just
-# *avoid* making changes to this part.
-
-# The location of the virtualenv that code executions in the sandbox will use.
-# This is a critical path, as SAND_VENV/bin/python is what is targeted by the
-# AppArmor confinement. It must also match the Django setting
-# `CODE_JAIL.python_bin`. The codejail docs refer to this as ``.
-ARG SAND_VENV=/sandbox/venv
-# The user account that will run code executions, described just as "the sandbox
-# user" in codejail docs. This needs to match the Django setting
-# `CODE_JAIL.user` and the sudoers file.
-ARG SAND_USER=sandbox
-# Same situation as for APP_UID
-ARG SAND_UID=33552349
-ARG SAND_GID=$SAND_UID
-# The user account that runs the regular web app, described in codejail docs as
-# ``. Needs to match the sudoers file.
-ARG APP_USER=app
-
-# The codejail-service API tests check for the visibility of this environment
-# variable from the sandbox. (It should not be visible.) This helps test for
-# environment leakage into the sandbox.
-ENV CJS_TEST_ENV_LEAKAGE=yes
-
-# Packages installed:
-#
-# - language-pack-en, locales: Ubuntu locale support so that system utilities
-# have a consistent language and time zone.
-# - sudo: Web user (`APP_USER`) needs to be able to sudo as `SAND_USER`
-# - python*: Specific versions of Python -- the service runs with a recent version, but
-# the sandboxed code will usually need a different (older) version. This is also why
-# we need to pull in the deadsnakes PPA.
-# - python*-dev: Header files for python extensions, required by many source wheels
-# - python*-venv: Allow creation of virtualenvs
-#
-# We also have to do a bit of bootstrapping here installing the
-# `software-properties-common` package gives us `add-apt-repository`, which
-# allows us to add the deadsnakes PPA more easily (that is, without messing
-# about with repository keys).
-RUN <`.
+ARG SAND_VENV=/sandbox/venv
+# The user account that will run code executions, described just as "the sandbox
+# user" in codejail docs. This needs to match the Django setting
+# `CODE_JAIL.user` and the sudoers file.
+ARG SAND_USER=sandbox
+# Same situation as for APP_UID
+ARG SAND_UID=33552349
+ARG SAND_GID=$SAND_UID
+# The user account that runs the regular web app, described in codejail docs as
+# ``. Needs to match the sudoers file.
+ARG APP_USER=app
+
+# The codejail-service API tests check for the visibility of this environment
+# variable from the sandbox. (It should not be visible.) This helps test for
+# environment leakage into the sandbox.
+ENV CJS_TEST_ENV_LEAKAGE=yes
+
+# Packages installed:
+#
+# - language-pack-en, locales: Ubuntu locale support so that system utilities
+# have a consistent language and time zone.
+# - sudo: Web user (`APP_USER`) needs to be able to sudo as `SAND_USER`
+# - python*: Specific versions of Python -- the service runs with a recent version, but
+# the sandboxed code will usually need a different (older) version. This is also why
+# we need to pull in the deadsnakes PPA.
+# - python*-dev: Header files for python extensions, required by many source wheels
+# - python*-venv: Allow creation of virtualenvs
+#
+# We also have to do a bit of bootstrapping here installing the
+# `software-properties-common` package gives us `add-apt-repository`, which
+# allows us to add the deadsnakes PPA more easily (that is, without messing
+# about with repository keys).
+RUN <