|  | Commit message (Collapse) | Author | Age | Lines | 
|---|
| ... |  | 
| | | 
| | 
| | 
| | 
| | 
| | 
| | 
| | | Ensure the cgroupv2 mount exists, subtree_control is not empty, and
swap is disabled.
Fix #126
Fix #102 | 
| | | |  | 
| |/ |  | 
| | |  | 
| |\ |  | 
| | | 
| | 
| | 
| | 
| | 
| | 
| | | Remove the rename step from the protobuf generation script to get around
a bug causing failures in the test suite.
Signed-off-by: Hassan Abouelela <[email protected]> | 
| |/  
|   
|   
|   
|   
|   
|   
| | Bumps protobuf from ~=3.14 to ==3.19. 3.19 was already a valid upgrade
from ~=3.14, but it introduced a breaking bug. The dependency has been
locked for now to avoid any more unintended bugs.
Signed-off-by: Hassan Abouelela <[email protected]> | 
| |\ |  | 
| |/ |  | 
| |\  
| | 
| | | Add the --use_cgroupv2 flag when relevant | 
| | | |  | 
| |/  
|   
|   
| | According to https://github.com/google/nsjail/pull/119, the  flag should be passed for NsJail to try to use cgroupv2. This commit will use the /sys/fs/cgroup structure to guess the installed version, and depending on the version add that flag. | 
| |\ |  | 
| |/ |  | 
| | |  | 
| |\ |  | 
| | | 
| | 
| | 
| | | Signed-off-by: Hassan Abouelela <[email protected]> | 
| | | 
| | 
| | 
| | | Signed-off-by: Hassan Abouelela <[email protected]> | 
| |/  
|   
|   
| | Signed-off-by: Hassan Abouelela <[email protected]> | 
| |\ |  | 
| | | 
| | 
| | 
| | | This test ensures that spawned child processes inherit the same resource group as the parent by spawning 2 child processes which each allocate a 40MB object, it then verifies that one of the child processes was killed with SIGKILL for violating the resource quota. | 
| | | |  | 
| | | 
| | 
| | 
| | | We define a few environment variables to stop third party libraries trying to default to spawning more processes, with the PID limit modification we can increase these values. | 
| |/  
|   
|   
| | Processes spawned in snekbox now have up to 5 PIDs available, each sharing the same memory limits and environment as the parent python process. As far as I could see in testing this does appear safe and processes behave as expected even when detatching from the parent or exceeding memory limits. | 
| | |  | 
| |\  
| | 
| | | Env deps: add tzdata | 
| |/  
|   
|   
|   
|   
|   
|   
| | Snekbox is lacking an IANA timezone database, this first-party `tzdata` package will provide them. It can be tested by running the following script:
```py
import zoneinfo
if len(zoneinfo.available_timezones()) == 0:
    print("The environment doesn't have a valid IANA database.")
``` | 
| | 
| 
| 
| 
| 
| 
| 
| 
| 
| 
| 
| 
| 
| | Bumps [urllib3](https://github.com/urllib3/urllib3) from 1.26.4 to 1.26.5.
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](https://github.com/urllib3/urllib3/compare/1.26.4...1.26.5)
---
updated-dependencies:
- dependency-name: urllib3
  dependency-type: indirect
...
Signed-off-by: dependabot[bot] <[email protected]> | 
| |\ |  | 
| | | |  | 
| | | 
| | 
| | 
| | | Co-authored-by: Mark <[email protected]> | 
| | | |  | 
| | | |  | 
| | | |  | 
| | | |  | 
| | | |  | 
| |/ |  | 
| |\  
| | 
| | 
| | | Use PYTHONIOENCODING to enable utf-8 stdout for the nsjail pipe,
and handle the potential case where this is bypassable. | 
| | | |  | 
| | | |  | 
| | | |  | 
| |/  
|   
|   
|   
|   
|   
|   
|   
|   
| | the potential case where this is bypassable
Since snekbox does not run with a tty, stdout is technically raw bytes, and thus incomplete surrogate pairs can be printed without the client application erroring, and instead fail within _consume_stdout when we attempt to decode it to a str.
This commit sets the PYTHONIOENCODING environment variable to inform python to open the pipe in utf-8 mode.
However, clever use of execl and os.unsetenv() can unset this environment variable, so we add a safety check to _consume_stdout to fail out of parsing output if it contains invalid unicode. This should only happen in deliberate cases, or significant bugs in python or a c library where output is printed to stdout ignoring the python stdout encoding. | 
| | 
| 
| 
| 
| 
| 
| 
| | Bumps [urllib3](https://github.com/urllib3/urllib3) from 1.26.3 to 1.26.4.
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](https://github.com/urllib3/urllib3/compare/1.26.3...1.26.4)
Signed-off-by: dependabot[bot] <[email protected]> | 
| | |  | 
| |\ |  | 
| |/ |  | 
| | 
| 
| 
| 
| | It needs setuptools which requires --ignore-installed to be used.
That causes all dependencies to be re-installed and therefore always
invalidates the cache. Not worth it. | 
| | |  | 
| |\  
| | 
| | | Bump urllib3 from 1.26.2 to 1.26.3 | 
| |/  
|   
|   
|   
|   
|   
|   
| | Bumps [urllib3](https://github.com/urllib3/urllib3) from 1.26.2 to 1.26.3.
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](https://github.com/urllib3/urllib3/compare/1.26.2...1.26.3)
Signed-off-by: dependabot[bot] <[email protected]> |