From a10f9fd0315b2b67e297bd529cc3d59fd667eb2d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mois=C3=A9s=20Gonz=C3=A1lez?= Date: Fri, 8 May 2026 17:56:49 -0400 Subject: [PATCH] feat!: support for verawood --- CHANGELOG.md | 35 ++- README.md | 78 +++--- pyproject.toml | 4 +- tutorcodejail/patches/cms-env | 2 +- tutorcodejail/patches/k8s-deployments | 52 +--- tutorcodejail/patches/k8s-services | 9 +- .../patches/kustomization-configmapgenerator | 9 +- tutorcodejail/patches/lms-env | 2 +- .../patches/local-docker-compose-dev-services | 8 - .../patches/local-docker-compose-services | 25 +- tutorcodejail/plugin.py | 87 +++---- .../apps/codejail-service-v2/tutor.py | 34 --- .../templates/codejail/apps/codejail/tutor.py | 42 ++- .../build/codejail-service/Dockerfile | 173 ------------- .../codejail/build/codejail/Dockerfile | 239 ++++++++++++------ uv.lock | 8 +- 16 files changed, 309 insertions(+), 498 deletions(-) delete mode 100644 tutorcodejail/templates/codejail/apps/codejail-service-v2/tutor.py delete mode 100644 tutorcodejail/templates/codejail/build/codejail-service/Dockerfile diff --git a/CHANGELOG.md b/CHANGELOG.md index 534d181..5bb099f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -13,6 +13,27 @@ See the fragment files in the [changelog.d/ directory](./changelog.d). + +## 22.0.0 — 2026-08-12 + +### Added + +- Support for the Verawood release. + +### Changed + +- The default AppArmor Profile now requires AppArmor 4, which available on + ubuntu 24.04 or newer. +- AppArmor enforcement is now a requirement and can not be turned off. +- The container name and internal services for kubernetes and docker was changed + from `codejailservice` to `codejail`. + +### Removed + +- Support for the old remote service implementation of codejail service + ([codejailservice](https://github.com/edunext/codejailservice.git)] has been + dropped. + ## 21.0.1 — 2026-05-08 @@ -25,7 +46,7 @@ See the fragment files in the [changelog.d/ directory](./changelog.d). ## 21.0.0 - 2025-11-04 - feat!: add support for the Ulmo release - + This changes also include support for openedx/codejail-service as an alternative implementation of the safe_exec REST API. @@ -44,14 +65,14 @@ See the fragment files in the [changelog.d/ directory](./changelog.d). appropriate labels. - feat: use an "init service" to load the apparmor profile (#63) - + This follows the same logic as the "permissions" service used by tutor core. The `codejail-apparmor-loader` service runs the command used previously by the init job. - + It makes more sense to handling loading of the apparmor profile with an init service: - + - The profile is ephemeral, rebooting the host will require to load it again. - The profile is a dependency for the container to start. Things like @@ -147,7 +168,7 @@ See the fragment files in the [changelog.d/ directory](./changelog.d). - Add support for Olive release (#28). - Adds mantainer group. -## 14.1.0 - 2022-09-26 +## 14.1.0 - 2022-09-26 ### Added @@ -163,14 +184,14 @@ See the fragment files in the [changelog.d/ directory](./changelog.d). - Bump version according tutor practices for Nutmeg release. -## 13.0.0 - 2022-05-02 +## 13.0.0 - 2022-05-02 ### Added - Add repo documentation. - Bump version according tutor practices for Maple release. -## 12.0.2 - 2022-04-29 +## 12.0.2 - 2022-04-29 ### Added diff --git a/README.md b/README.md index 41d778b..884ba93 100644 --- a/README.md +++ b/README.md @@ -7,17 +7,6 @@ This plugin configures and runs a remote CodeJail Service instance that implements the safe-exec API used by the Open edX platform to offer more advanced capabilities to course authors. -Starting from the Ulmo release, the codejail plugin is transitioning to an -alternative implementation of the safe-exec API ( -[Codejail Service V2](https://github.com/openedx/codejail-service)). You can -opt-in to use this new implementation on Ulmo before it finally becomes the -default on the Verawood release. - -> [!NOTE] -> The new CodeJail Service implementation is based on Django instead of Flask, -> therefore settings changed with the `codejail-*-settings` patches must be -> adjusted accordingly. - ## Installation To install the latest version, run: @@ -47,38 +36,35 @@ aa-enabled To customize the configuration, update the following settings in Tutor: - `CODEJAIL_APPARMOR_DOCKER_IMAGE`: (default: `docker.io/ednxops/codejail_apparmor_loader:latest`) -- `CODEJAIL_DOCKER_IMAGE_V2` : (default: `{{ CODEJAIL_DOCKER_IMAGE }}-v2`) - `CODEJAIL_DOCKER_IMAGE`: (default: `docker.io/ednxops/codejailservice:{{__version__}}`) - `CODEJAIL_ENABLE_K8S_DAEMONSET` (default: `False`) -- `CODEJAIL_ENFORCE_APPARMOR` (default: `True`) - `CODEJAIL_EXTRA_PIP_REQUIREMENTS` (default: `[]`) -- `CODEJAIL_SANDBOX_PYTHON_VERSION` (default: `3.11.9`) -- `CODEJAIL_SERVICE_REPOSITORY` (default: `https://github.com/edunext/codejailservice.git`\`) +- `CODEJAIL_SANDBOX_PYTHON_VERSION` (default: `3.12`) +- `CODEJAIL_SERVICE_REPOSITORY` (default: `https://github.com/openedx/codejail-service.git`) - `CODEJAIL_SERVICE_VERSION` (default: `{{ OPENEDX_COMMON_VERSION }}`), -- `CODEJAIL_SERVICE_V2_REPOSITORY`: (default: `https://github.com/openedx/codejail-service.git`) -- `CODEJAIL_SERVICE_V2_VERSION`: (default: `{{ OPENEDX_COMMON_VERSION }}`) -- `CODEJAIL_USE_SERVICE_V2`: (default: `False`) - -The `CODEJAIL_*_SERVICE_V2` settings are meant to be used only during the Ulmo -release and will be phased-out during the Verawood release. - -To opt-in to the new implementation of the code-exec API set -`CODEJAIL_USE_SERVICE_V2` to `True` and re-deploy your environment. If you are -using a a custom image for the codejail service you will need to rebuild -it with `CODEJAIL_USE_SERVICE_V2` set to `True`. ### Custom Image In most cases, you can work with the provided Docker image for the -release. You will need to build a custom image if you either: - -- Need additional packages installed in the sandbox environment. Use the setting - `CODEJAIL_EXTRA_PIP_REQUIREMENTS` to define the list of additional packages. -- Need to run the sandbox environment under a different Python version. The - default Python version of the sandbox might get updated between releases, - potentially breaking instructor generated code. You can set - `CODEJAIL_SANDBOX_PYTHON_VERSION` to an older version to avoid disruption - while figuring out a migration plan. +release. However, there might be cases when a custom image will be necessary: + +- If you need additional packages installed in the sandbox environment. Use the + setting `CODEJAIL_EXTRA_PIP_REQUIREMENTS` to define the list of additional + packages. +- If you need to run the sandbox environment under a different Python version + you can use `CODEJAIL_SANDBOX_PYTHON_VERSION`. This is particularly useful + when the sandbox version is upgraded between releases but you need to figure + out a migration plan for instructor code. +- If you need a completely different set of packages in the sandbox virtual + environment. In this case you will need to point to a requirements file using + the following docker build arguments: `SANDBOX_DEPS_REPO`, + `SANDBOX_DEPS_VERSION`, `SANDBOX_DEPS_SRC_DIR` and `SANDBOX_DEPS_SRC_FILE`. + Their current default values are + `https://github.com/openedx/codejail-service.git`, `{{ OPENEDX_COMMON_VERSION + }}`, `requirements/sandbox` and `base.txt`. This will point to + https://github.com/openedx/codejail-service/blob/release/verawood.1/requirements/base.txt + for the Verawood release. You can provide the arguments to Tutor as follows + `tutor images build codejail -a SANDBOX_DEPS_VERSION=ulmo2`. ## Kubernetes Support @@ -94,10 +80,6 @@ and has successfully loaded the profile. You can enable a helper Daemon Set that will load the profile onto all the nodes by setting `CODEJAIL_ENABLE_K8S_DAEMONSET` to true. -If you choose to run the service without enforcing the AppArmor profile -(absolutely discouraged, and not possible on the newer implementation of -codejail-service), you can set `CODEJAIL_ENFORCE_APPARMOR` to `False`. - More info about this discussion can be found on [this issue](https://github.com/eduNEXT/tutor-contrib-codejail/issues/24). @@ -117,8 +99,24 @@ width="725px"} In this case, the section\'s content will render correctly and work as specified in the instructions of the problem. +## New CodeJail Service implementation + +The Ulmo release introduced support for deploying a new +implementation of the remote CodeJail service (openedx/codejail-service). The +Verawood release completely removes support for deploying the old version of the +service (edunext/codejailservice). Users should be mindful of the following +points when upgrading: + +1. The new CodeJail service **requires** AppArmor 4 on the host machine. + AppArmor 4 is available on relatively new Debian based distributions (ubuntu + 24.04, Debian Trixie, etc). +2. AppArmor enforcement is no longer optional. The new CodeJail service performs + startup checks to ensure the sandbox is properly isolated and will not start + if the AppArmor profile is not loaded and configured. +3. The new CodeJail service implementation is based on Django instead of Flask. + Any usage of the `codejail-*-settings` must be adjusted accordingly. + ## License This software is licensed under the terms of the AGPLv3. See the LICENSE file for details. - diff --git a/pyproject.toml b/pyproject.toml index 86f94c6..3a85430 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,6 +1,6 @@ [project] name = "tutor-contrib-codejail" -version = "21.0.1" +version = "22.0.0" description = "Codejail plugin for Tutor" readme = "README.md" license-files = ["LICENSE"] @@ -9,7 +9,7 @@ authors = [ ] requires-python = ">=3.10" dependencies = [ - "tutor~=21.0" + "tutor~=22.0" ] classifiers = [ "Development Status :: 3 - Alpha", diff --git a/tutorcodejail/patches/cms-env b/tutorcodejail/patches/cms-env index 10a52f8..4c8b040 100644 --- a/tutorcodejail/patches/cms-env +++ b/tutorcodejail/patches/cms-env @@ -1,4 +1,4 @@ ENABLE_CODEJAIL_REST_SERVICE: true -CODE_JAIL_REST_SERVICE_HOST: "http://{{ CODEJAIL_HOST }}:8550" +CODE_JAIL_REST_SERVICE_HOST: "http://codejail:8000" CODE_JAIL_REST_SERVICE_CONNECT_TIMEOUT: 0.5 CODE_JAIL_REST_SERVICE_READ_TIMEOUT: 3.5 diff --git a/tutorcodejail/patches/k8s-deployments b/tutorcodejail/patches/k8s-deployments index f22d9e5..f9dec16 100644 --- a/tutorcodejail/patches/k8s-deployments +++ b/tutorcodejail/patches/k8s-deployments @@ -1,27 +1,26 @@ --- -{% if CODEJAIL_USE_SERVICE_V2 %} apiVersion: apps/v1 kind: Deployment metadata: - name: codejailservice + name: codejail labels: - app.kubernetes.io/name: codejailservice + app.kubernetes.io/name: codejail spec: selector: matchLabels: - app.kubernetes.io/name: codejailservice + app.kubernetes.io/name: codejail template: metadata: labels: - app.kubernetes.io/name: codejailservice + app.kubernetes.io/name: codejail spec: securityContext: appArmorProfile: type: Localhost localhostProfile: openedx_codejail_service containers: - - name: codejailservice - image: {{ CODEJAIL_DOCKER_IMAGE_V2 }} + - name: codejail + image: {{ CODEJAIL_DOCKER_IMAGE }} ports: - containerPort: 8550 env: @@ -35,45 +34,6 @@ spec: - name: settings-codejail configMap: name: settings-codejail -{% else %} -apiVersion: apps/v1 -kind: Deployment -metadata: - name: codejailservice - labels: - app.kubernetes.io/name: codejailservice -spec: - selector: - matchLabels: - app.kubernetes.io/name: codejailservice - template: - metadata: - labels: - app.kubernetes.io/name: codejailservice - spec: - {% if CODEJAIL_ENFORCE_APPARMOR %} - securityContext: - appArmorProfile: - type: Localhost - localhostProfile: docker-edx-sandbox - {% endif %} - containers: - - name: codejailservice - image: {{ CODEJAIL_DOCKER_IMAGE }} - ports: - - containerPort: 8550 - env: - - name: FLASK_APP_SETTINGS - value: codejailservice.tutor.ProductionConfig - volumeMounts: - - mountPath: /openedx/codejailservice/codejailservice/tutor.py - name: settings-codejail - subPath: tutor.py - volumes: - - name: settings-codejail - configMap: - name: settings-codejail -{% endif %} {% if CODEJAIL_ENABLE_K8S_DAEMONSET %} --- apiVersion: apps/v1 diff --git a/tutorcodejail/patches/k8s-services b/tutorcodejail/patches/k8s-services index 7b259c1..49736e2 100644 --- a/tutorcodejail/patches/k8s-services +++ b/tutorcodejail/patches/k8s-services @@ -2,13 +2,14 @@ apiVersion: v1 kind: Service metadata: - name: codejailservice + name: codejail labels: - app.kubernetes.io/name: codejailservice + app.kubernetes.io/name: codejail spec: type: ClusterIP ports: - - port: 8550 + - port: 8000 protocol: TCP + name: http selector: - app.kubernetes.io/name: codejailservice + app.kubernetes.io/name: codejail diff --git a/tutorcodejail/patches/kustomization-configmapgenerator b/tutorcodejail/patches/kustomization-configmapgenerator index e1adba7..f232d94 100644 --- a/tutorcodejail/patches/kustomization-configmapgenerator +++ b/tutorcodejail/patches/kustomization-configmapgenerator @@ -1,17 +1,12 @@ - name: codejail-profile files: - - plugins/codejail/apps/profiles/docker-edx-sandbox.profile - plugins/codejail/apps/profiles/openedx-codejail-service.profile options: labels: app.kubernetes.io/name: codejail-aa-loader -- name: settings-codejail +- name: codejail-settings files: - {% if CODEJAIL_USE_SERVICE_V2 %} - - plugins/codejail/apps/codejail-service-v2/tutor.py - {% else %} - plugins/codejail/apps/codejail/tutor.py - {% endif %} options: labels: - app.kubernetes.io/name: codejailservice + app.kubernetes.io/name: codejail diff --git a/tutorcodejail/patches/lms-env b/tutorcodejail/patches/lms-env index 10a52f8..4c8b040 100644 --- a/tutorcodejail/patches/lms-env +++ b/tutorcodejail/patches/lms-env @@ -1,4 +1,4 @@ ENABLE_CODEJAIL_REST_SERVICE: true -CODE_JAIL_REST_SERVICE_HOST: "http://{{ CODEJAIL_HOST }}:8550" +CODE_JAIL_REST_SERVICE_HOST: "http://codejail:8000" CODE_JAIL_REST_SERVICE_CONNECT_TIMEOUT: 0.5 CODE_JAIL_REST_SERVICE_READ_TIMEOUT: 3.5 diff --git a/tutorcodejail/patches/local-docker-compose-dev-services b/tutorcodejail/patches/local-docker-compose-dev-services index b092da1..e69de29 100644 --- a/tutorcodejail/patches/local-docker-compose-dev-services +++ b/tutorcodejail/patches/local-docker-compose-dev-services @@ -1,8 +0,0 @@ -codejailservice: - command: flask run --host 0.0.0.0 --port 8550 - environment: - FLASK_ENV: development - FLASK_APP_SETTINGS: codejailservice.tutor.DevelopmentConfig - ports: - - "8550:8550" - restart: unless-stopped diff --git a/tutorcodejail/patches/local-docker-compose-services b/tutorcodejail/patches/local-docker-compose-services index a40ad88..e101e83 100644 --- a/tutorcodejail/patches/local-docker-compose-services +++ b/tutorcodejail/patches/local-docker-compose-services @@ -1,35 +1,16 @@ #############Codejail service -{% if CODEJAIL_USE_SERVICE_V2 %} -codejailservice: - image: {{ CODEJAIL_DOCKER_IMAGE_V2 }} - ports: - - 8550:8550 +codejail: + image: {{ CODEJAIL_DOCKER_IMAGE }} environment: DJANGO_SETTINGS_MODULE: codejail_service.settings.tutor security_opt: - apparmor:openedx_codejail_service volumes: - - ../plugins/codejail/apps/codejail-service-v2/tutor.py:/app/codejail_service/settings/tutor.py:ro - restart: unless-stopped - depends_on: - codejail-apparmor-loader: - condition: service_completed_successfully -{% else %} -codejailservice: - image: {{ CODEJAIL_DOCKER_IMAGE }} - environment: - FLASK_APP_SETTINGS: codejailservice.tutor.ProductionConfig - {% if CODEJAIL_ENFORCE_APPARMOR %} - security_opt: - - apparmor:docker-edx-sandbox - {% endif %} - volumes: - - ../plugins/codejail/apps/codejail/tutor.py:/openedx/codejailservice/codejailservice/tutor.py:ro + - ../plugins/codejail/apps/codejail/tutor.py:/app/codejail_service/settings/tutor.py:ro restart: unless-stopped depends_on: codejail-apparmor-loader: condition: service_completed_successfully -{% endif %} codejail-apparmor-loader: image: {{ CODEJAIL_APPARMOR_DOCKER_IMAGE }} diff --git a/tutorcodejail/plugin.py b/tutorcodejail/plugin.py index 483c908..f0468be 100644 --- a/tutorcodejail/plugin.py +++ b/tutorcodejail/plugin.py @@ -8,7 +8,6 @@ import importlib_resources from tutor import hooks -from tutor.types import Config from .__about__ import __version__ @@ -21,18 +20,13 @@ "defaults": { "APPARMOR_DOCKER_IMAGE": "docker.io/ednxops/codejail_apparmor_loader:apparmor-4", "DOCKER_IMAGE": f"docker.io/ednxops/codejailservice:{__version__}", - "DOCKER_IMAGE_V2": "{{ CODEJAIL_DOCKER_IMAGE }}-v2", "ENABLE_K8S_DAEMONSET": False, "ENFORCE_APPARMOR": True, "EXTRA_PIP_REQUIREMENTS": [], - "HOST": "codejailservice", - "SANDBOX_PYTHON_VERSION": "3.11.14", - "SERVICE_REPOSITORY": "https://github.com/edunext/codejailservice.git", - "SERVICE_V2_REPOSITORY": "https://github.com/openedx/codejail-service.git", - "SERVICE_V2_VERSION": "{{ OPENEDX_COMMON_VERSION }}", + "SANDBOX_PYTHON_VERSION": "3.12", + "SERVICE_REPOSITORY": "https://github.com/openedx/codejail-service.git", "SERVICE_VERSION": "{{ OPENEDX_COMMON_VERSION }}", "SKIP_INIT": False, - "USE_SERVICE_V2": False, "VERSION": __version__, }, "overrides": {}, @@ -71,60 +65,47 @@ def get_apparmor_abi(): ] ) +hooks.Filters.IMAGES_BUILD.add_item( + ( + "codejail", + ("plugins", "codejail", "build", "codejail"), + "{{ CODEJAIL_DOCKER_IMAGE }}", + (), + ), +) +hooks.Filters.IMAGES_PULL.add_item( + ( + "codejail", + "{{ CODEJAIL_DOCKER_IMAGE }}", + ) +) +hooks.Filters.IMAGES_PUSH.add_item( + ( + "codejail", + "{{ CODEJAIL_DOCKER_IMAGE }}", + ) +) -@hooks.Filters.IMAGES_BUILD.add() -def _build_codejail_images( - images: list[tuple[str, str | tuple[str, ...], str, tuple[str, ...]]], - tutor_config: Config, -): - """Choose the appropiate build context when using CODEJAIL_USE_SERVICE_V2.""" - # TODO: Remove after the Verawood update - if tutor_config.get("CODEJAIL_USE_SERVICE_V2"): - codejail_img = ( - "codejail", - "plugins/codejail/build/codejail-service", - "{{ CODEJAIL_DOCKER_IMAGE_V2 }}", - (), - ) - else: - codejail_img = ( - "codejail", - "plugins/codejail/build/codejail", - "{{ CODEJAIL_DOCKER_IMAGE }}", - (), - ) - apparmor_img = ( +hooks.Filters.IMAGES_BUILD.add_item( + ( "codejail_apparmor", ("plugins", "codejail", "build", "codejail_apparmor"), "{{CODEJAIL_APPARMOR_DOCKER_IMAGE}}", (), + ), +) +hooks.Filters.IMAGES_PULL.add_item( + ( + "codejail_apparmor", + "{{CODEJAIL_APPARMOR_DOCKER_IMAGE}}", ) - - return images + [codejail_img, apparmor_img] - - -@hooks.Filters.IMAGES_PUSH.add() -def _push_codejail_images( - images: list[tuple[str, str]], - tutor_config: Config, -): - """Choose the appropiate image tag when using CODEJAIL_USE_SERVICE_V2.""" - # TODO: Remove after the Verawood update - if tutor_config.get("CODEJAIL_USE_SERVICE_V2"): - codejail_img = ( - "codejail", - "{{ CODEJAIL_DOCKER_IMAGE_V2 }}", - ) - else: - codejail_img = ( - "codejail", - "{{ CODEJAIL_DOCKER_IMAGE }}", - ) - apparmor_img = ( +) +hooks.Filters.IMAGES_PUSH.add_item( + ( "codejail_apparmor", "{{CODEJAIL_APPARMOR_DOCKER_IMAGE}}", ) - return images + [codejail_img, apparmor_img] +) # Boilerplate code diff --git a/tutorcodejail/templates/codejail/apps/codejail-service-v2/tutor.py b/tutorcodejail/templates/codejail/apps/codejail-service-v2/tutor.py deleted file mode 100644 index 172a72b..0000000 --- a/tutorcodejail/templates/codejail/apps/codejail-service-v2/tutor.py +++ /dev/null @@ -1,34 +0,0 @@ -from codejail_service.settings.local import * # pylint: disable=wildcard-import - -ALLOWED_HOSTS = [ - 'codejailservice', - 'localhost', -] - -CODEJAIL_ENABLED = True -SECRET_KEY = '{{ CODEJAIL_SECRET_KEY }}' - -CODE_JAIL = { - 'python_bin': '/sandbox/venv/bin/python', - 'user': 'sandbox', - - # Configurable limits. - 'limits': { - # CPU-seconds - 'CPU': 3, - # Clock seconds - 'REALTIME': 3, - # Need at least 300 MiB memory for matplotlib alone. 512 MiB should be - # enough headroom in general. - 'VMEM': 512 * 1024 * 1024, - # 10 MB file size limit - 'FSIZE': 10 * 1024 * 1024, - # 15 processes and threads (codejail default) - 'NPROC': 15, - # Don't use a proxy process to spawn subprocesses. - 'PROXY': 0, - }, -} - -{{ patch("codejail-common-settings") }} -{{ patch("codejail-production-settings") }} diff --git a/tutorcodejail/templates/codejail/apps/codejail/tutor.py b/tutorcodejail/templates/codejail/apps/codejail/tutor.py index df72ab4..592643d 100644 --- a/tutorcodejail/templates/codejail/apps/codejail/tutor.py +++ b/tutorcodejail/templates/codejail/apps/codejail/tutor.py @@ -1,18 +1,34 @@ -"""Module with the configuration of config classes.""" -from codejailservice.config import DevelopmentConfig, ProductionConfig +from codejail_service.settings.local import * # pylint: disable=wildcard-import +ALLOWED_HOSTS = [ + 'codejail', + 'localhost', +] -class DevelopmentConfig(DevelopmentConfig): - """Class to use for development context that inherits from DevelopmentConfig.""" +CODEJAIL_ENABLED = True +SECRET_KEY = '{{ CODEJAIL_SECRET_KEY }}' - CODE_JAIL = DevelopmentConfig.CODE_JAIL - {{patch("codejail-common-settings") | indent(4)}} - {{patch("codejail-development-settings") | indent(4)}} +CODE_JAIL = { + 'python_bin': '/sandbox/venv/bin/python', + 'user': 'sandbox', + # Configurable limits. + 'limits': { + # CPU-seconds + 'CPU': 3, + # Clock seconds + 'REALTIME': 3, + # Need at least 300 MiB memory for matplotlib alone. 512 MiB should be + # enough headroom in general. + 'VMEM': 512 * 1024 * 1024, + # 10 MB file size limit + 'FSIZE': 10 * 1024 * 1024, + # 15 processes and threads (codejail default) + 'NPROC': 15, + # Don't use a proxy process to spawn subprocesses. + 'PROXY': 0, + }, +} -class ProductionConfig(ProductionConfig): - """Class to use for production context that inherits from ProductionConfig.""" - - CODE_JAIL = ProductionConfig.CODE_JAIL - {{patch("codejail-common-settings") | indent(4)}} - {{patch("codejail-production-settings") | indent(4)}} +{{ patch("codejail-common-settings") }} +{{ patch("codejail-production-settings") }} diff --git a/tutorcodejail/templates/codejail/build/codejail-service/Dockerfile b/tutorcodejail/templates/codejail/build/codejail-service/Dockerfile deleted file mode 100644 index a62f8cd..0000000 --- a/tutorcodejail/templates/codejail/build/codejail-service/Dockerfile +++ /dev/null @@ -1,173 +0,0 @@ -FROM scratch AS codejail-service-code -ARG CODEJAIL_SERVICE_REPO={{ CODEJAIL_SERVICE_V2_REPOSITORY }} -ARG CODEJAIL_SERVICE_VERSION={{ CODEJAIL_SERVICE_V2_VERSION }} -ADD ${CODEJAIL_SERVICE_REPO}#${CODEJAIL_SERVICE_VERSION} / - -FROM scratch AS sandbox-dependencies -# Where to get the Python dependencies lockfile for installing -# packages into the sandbox environment. Defaults to the codejail -# dependencies in edx-platform. -ARG SANDBOX_DEPS_REPO={{ EDX_PLATFORM_REPOSITORY }} -ARG SANDBOX_DEPS_VERSION={{ CODEJAIL_SERVICE_V2_VERSION }} -# Path to the lockfile in the deps repo, as dir + filename. -# -# The path base.txt will get the latest dependencies, but this needs -# to be coordinated with SANDBOX_PY_VER as each release has a -# different Python support window. -ARG SANDBOX_DEPS_SRC_DIR=requirements/edx-sandbox -ADD ${SANDBOX_DEPS_REPO}#${SANDBOX_DEPS_VERSION}:${SANDBOX_DEPS_SRC_DIR} / - -FROM docker.io/ubuntu:24.04 AS app -ARG APP_PY_VER=3.12 -# See codejail-service deployment and configuration docs for why we need to select -# a UID/GID that is unlikely to collide with anything on the host. (Short answer: -# RLIMIT_NPROC UID-global usage pool, and Docker not isolating UIDs.) -# -# Selected via: python3 -c 'import random; print(random.randrange(3000, 2 ** 31))' -ARG APP_UID=15826504 -ARG APP_GID=$APP_UID - -ARG SANDBOX_DEPS_SRC_FILE=base.txt - -# Python version for sandboxed executions. This must be coordinated with -# `SANDBOX_DEPS_SRC_*` to ensure compatibility. -ARG SANDBOX_PY_VER={{ '.'.join(CODEJAIL_SANDBOX_PYTHON_VERSION.split('.')[:2]) }} - - -##### Base app installation ##### - -ENV DEBIAN_FRONTEND=noninteractive -ARG APT_INSTALL="apt-get install --quiet --yes --no-install-recommends" - -# The codejail library specifies a certain structure to how the sandboxing is -# performed. (See the documentation in the codejail library README: -# https://github.com/openedx/codejail). -# -# Some of this structure can be changed, and some cannot. Any changes that are -# possible will also need to be coordinated with changes to the apparmor profile -# as well as to the `CODE_JAIL` Django settings. Accordingly, it's best to just -# *avoid* making changes to this part. - -# The location of the virtualenv that code executions in the sandbox will use. -# This is a critical path, as SAND_VENV/bin/python is what is targeted by the -# AppArmor confinement. It must also match the Django setting -# `CODE_JAIL.python_bin`. The codejail docs refer to this as ``. -ARG SAND_VENV=/sandbox/venv -# The user account that will run code executions, described just as "the sandbox -# user" in codejail docs. This needs to match the Django setting -# `CODE_JAIL.user` and the sudoers file. -ARG SAND_USER=sandbox -# Same situation as for APP_UID -ARG SAND_UID=33552349 -ARG SAND_GID=$SAND_UID -# The user account that runs the regular web app, described in codejail docs as -# ``. Needs to match the sudoers file. -ARG APP_USER=app - -# The codejail-service API tests check for the visibility of this environment -# variable from the sandbox. (It should not be visible.) This helps test for -# environment leakage into the sandbox. -ENV CJS_TEST_ENV_LEAKAGE=yes - -# Packages installed: -# -# - language-pack-en, locales: Ubuntu locale support so that system utilities -# have a consistent language and time zone. -# - sudo: Web user (`APP_USER`) needs to be able to sudo as `SAND_USER` -# - python*: Specific versions of Python -- the service runs with a recent version, but -# the sandboxed code will usually need a different (older) version. This is also why -# we need to pull in the deadsnakes PPA. -# - python*-dev: Header files for python extensions, required by many source wheels -# - python*-venv: Allow creation of virtualenvs -# -# We also have to do a bit of bootstrapping here installing the -# `software-properties-common` package gives us `add-apt-repository`, which -# allows us to add the deadsnakes PPA more easily (that is, without messing -# about with repository keys). -RUN <`. +ARG SAND_VENV=/sandbox/venv +# The user account that will run code executions, described just as "the sandbox +# user" in codejail docs. This needs to match the Django setting +# `CODE_JAIL.user` and the sudoers file. +ARG SAND_USER=sandbox +# Same situation as for APP_UID +ARG SAND_UID=33552349 +ARG SAND_GID=$SAND_UID +# The user account that runs the regular web app, described in codejail docs as +# ``. Needs to match the sudoers file. +ARG APP_USER=app + +# The codejail-service API tests check for the visibility of this environment +# variable from the sandbox. (It should not be visible.) This helps test for +# environment leakage into the sandbox. +ENV CJS_TEST_ENV_LEAKAGE=yes + +# Packages installed: +# +# - language-pack-en, locales: Ubuntu locale support so that system utilities +# have a consistent language and time zone. +# - sudo: Web user (`APP_USER`) needs to be able to sudo as `SAND_USER` +# - python*: Specific versions of Python -- the service runs with a recent version, but +# the sandboxed code will usually need a different (older) version. This is also why +# we need to pull in the deadsnakes PPA. +# - python*-dev: Header files for python extensions, required by many source wheels +# - python*-venv: Allow creation of virtualenvs +# +# We also have to do a bit of bootstrapping here installing the +# `software-properties-common` package gives us `add-apt-repository`, which +# allows us to add the deadsnakes PPA more easily (that is, without messing +# about with repository keys). +RUN <