diff options
| author |  MarkKoz <[email protected]> | 2019-12-28 15:17:34 -0800 |
|---|---|---|
| committer | MarkKoz <[email protected]> | 2019-12-28 20:53:29 -0800 |
| commit | b2fb654371a07a77ba4a39f11395836c6b593527 (patch) | |
| tree | 7b1c9deded3c936a0a4201bdfe6c2849b2482ed2 /README.md | |
| parent | Disable shared memory in Docker container (diff) | |
Mount only what's needed in the chroot jail
devfs and sysfs were problematic since they were being mounted as
tmpfs, which is r/w. For example, the Python process could write to
cgroups. Now, only what is needed to run Python gets mounted. This
boils down to the venv itself and some shared libraries Python needs.
* Use a config file for NsJail instead of command-line options
* Map 65534 (nobody) user & group inside the user namespace to 65534
outside the namespace rather than mapping to current uid/guid (which
was 0 AKA root)
Diffstat (limited to 'README.md')
| -rw-r--r-- | README.md | 2 |
1 files changed, 1 insertions, 1 deletions
@@ -24,7 +24,7 @@ result <- | |<----------| | <----------+ The code is executed in a Python process that is launched through [NsJail](https://github.com/google/nsjail), which is responsible for sandboxing the Python process. NsJail is configured as follows: -* Root directory is mounted as read-only +* All mounts are read-only * Time limit of 2 seconds * Maximum of 1 PID * Maximum memory of 52428800 bytes |