| Commit message (Collapse) | Author | Age | Lines |
| |
|
|
|
| |
Co-authored-by: Mark <[email protected]>
|
| |
|
| |
|
| |
|
|
|
|
|
|
|
|
| |
Separate snekbox's Python interpreter from the interpreter used by
NsJail. This allows for the interpreters to be updated on different
cadences and provides better isolation of packages.
Each Python interpreter adds about 70 MB to the built image.
|
| |
|
| |
|
|
|
| |
Co-authored-by: Mark <[email protected]>
|
| |
|
| |
|
| |
|
| |
|
| |
|
|
|
|
|
| |
Use a more unique name to avoid accidentally using the value of a
similar env var that was set for an unrelated reason.
|
|
|
|
| |
The values can effectively be set via the Gunicorn config instead.
|
| |
|
|
|
|
| |
The env var is no longer used anywhere.
|
| |
|
|
|
|
| |
Merge DEVELOPING.md into CONTRIBUTING.md
|
| |
|
| |
|
|
|
|
|
|
| |
The information is only relevant to developers. The README is what all
users will read; they shouldn't be subject to information that isn't
necessarily relevant to them.
|
|\ |
|
| | |
|
| |
| |
| |
| |
| |
| |
| |
| |
| | |
The Python script uses the same underlying code Falcon uses to invoke
nsjail. It allows for the omission of redundant shell code that set up
cgroups and nsjail args.
This is also a step towards removing dependence on shell scripts and
thus resolving #73.
|
| | |
|
| | |
|
|/
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The problem with --ignore-installed is that it also ignores packages in
the target site, therefore re-installing all packages and making caching
futile.
Install snekbox's dependencies to the default user site. During
installation of the exposed packages, switch the user site to a custom
one to ensure pip will not skip packages due to seeing them as already
installed as one of snekbox's dependencies.
If pip made the --root option ignore packages outside the root, then
using --root would be the best solution. There is a 5+ year old issue
open about that.
|
| |
|
| |
|
| |
|
|
|
|
|
|
| |
I've removed the redundant intermediate image build commands from the
Pipfile. Since everything is now contained in one Dockerfile, we can
simply build the final image in one go.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
I've migrated the build pipeline to GitHub Actions and changed the
container registry to GitHub Container Registry. In the process, I've
made some changes to our docker setup and caching:
- We are now using a single multi-stage Dockerfile
Instead of three separate dockerfiles, we are now using a
single multi-stage Dockerfile that can be used to build the three images
we want using build targets.
In part, this is because we're now using the docker buildx build action
currently recommended by docker. This new engine runs in a sandboxed
mode, meaning that while it can export built images to `docker` running
in the host, it cannot import local images from it to base builds on.
- Docker builds are now cached within GitHub Actions
The builds are now cached using the GitHub Actions cache of the build
cache directory. The cache keys try to match a cache generated by a
build that matches the current build as closely as possible. In case of
a cache miss, we fall back to caching from the latest image pushed to
the container repository.
- The `base` and `venv` images now have an inline cache manifest
In order to fall back intelligently to caching from the repository, the
final build and push action for the `base` and `venv` images includes an
"inline" cache manifest. This means that the build process can inspect,
without pulling, if it makes sense to pull layers to speed up the build.
The other options, pushing a cache manifest separately (not inline), is
currently not supported by GHCR.
The custom caching script has been removed.
- Linting errors are now added as GitHub Actions annotations
Just like for some of our other pipelines, linting now generates
annotations if linting errors are observed.
- Coverage is pushed to coveralls.io
A coverage summary is now pushed to coveralls.io. Each CI run will get a
unique job that's linked in the CI output. If the run is attached to a
PR, coveralls.io will automatically add a check link with the coverage
result to the PR as well.
- The README.md, Pipfile, docker-compose, and scripts have been updated
As we now need to pull from and link to the GHCR, I've updated the other
files to reflect these changes, including Pipfile run commands. I've
also changed the CI badge and added a coveralls.io badge.
|
| |
|
|
|
|
|
| |
There will be more config files to come so it's cleaner to have them
together than littering the root directory with more files.
|
| |
|
|
|
|
|
|
| |
As convenient as it may be, it is redundant to list out the config in
the docs. It also may fall out of sync with the actual config should
someone forget to update the docs.
|
|
|
|
| |
Makes the Markdown less cluttered when editing it.
|
|
|
|
|
|
|
|
| |
The current run instructions are geared towards developers. A simpler
way to run snekbox is to start a container with `docker run` via the
image published on Docker Hub.
Resolves #57
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
devfs and sysfs were problematic since they were being mounted as
tmpfs, which is r/w. For example, the Python process could write to
cgroups. Now, only what is needed to run Python gets mounted. This
boils down to the venv itself and some shared libraries Python needs.
* Use a config file for NsJail instead of command-line options
* Map 65534 (nobody) user & group inside the user namespace to 65534
outside the namespace rather than mapping to current uid/guid (which
was 0 AKA root)
|
|
|
|
| |
Forgot to do this after switching to Debian.
|
| |
|
| |
|
| |
|
|
|
|
|
|
|
| |
* Add a link to pipenv
* Remove the "Details" section; now part of the first "snekbox" section
* Clarify that snekbox uses a HTTP REST API
* Document the default host and port for the webserver
|
| |
|
|
|
|
|
|
|
|
| |
The builddev script will build just the dev venv image. The testb
script will build the dev venv image, clean up dangling images, and
then run tests.
* Give the coverage commands their own header in the README
|
|
|
|
|
|
| |
* Make the report script do the normal coverage report instead of HTML
* Remove Docker image push scripts
* Add image build script for the venv image
|