| Commit message (Collapse) | Author | Age | Lines |
|---|
| | |
|
| |
|
|
|
| |
There will be more config files to come so it's cleaner to have them
together than littering the root directory with more files.
|
| | |
|
| |
|
|
|
|
|
|
| |
Error handling is performed inside can_pull so the callers of the
function don't always check its exit code. Because set -e present, if
can_pull returns 1, bash would consider that function a failed call and
thus exit the entire script with code 1. That, in turn, would cause the
CI job to fail.
|
| | |
|
| |
|
|
| |
The array shouldn't be expanded when testing with -v.
|
| |
|
|
|
|
| |
The script may need to use the master commit several times. The easiest
way to implement the cache was to just cache the response rather than
the commit hash.
|
| | |
|
| | |
|
| |
|
|
|
|
| |
It was initially used to enable access to variables across jobs, but
the jobs will eventually be consolidated into one so output variables
will no longer be needed.
|
| | |
|
| |
|
|
| |
* Use inherit_errexit in check_dockerfiles.sh
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
| |
A virtual environment is redundant in the context of deployment. It
just increases the size and build time of the image.
* Replace venv with system interpreter
* Mount Python binaries in /usr/local/bin in NsJail
* Fix #61: Python symlink in venv not resolving
* Re-lock Pipfile because it wasn't up to date according to
pipenv install --deploy
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
| |
devfs and sysfs were problematic since they were being mounted as
tmpfs, which is r/w. For example, the Python process could write to
cgroups. Now, only what is needed to run Python gets mounted. This
boils down to the venv itself and some shared libraries Python needs.
* Use a config file for NsJail instead of command-line options
* Map 65534 (nobody) user & group inside the user namespace to 65534
outside the namespace rather than mapping to current uid/guid (which
was 0 AKA root)
|
| | |
|
| | |
|
| |
|
|
| |
Forgot to do this after switching to Debian.
|
| |\
| |
| | |
CI Improvements
|
| | |
| |
| |
| |
| | |
* Replace some shorthand Docker command options with their full names
for clarity
|
| | | |
|
| | |
| |
| |
| |
| |
| |
| |
| | |
* Move script's execution to the test job
* Use output variables
* Use jq instead of regex for parsing JSON responses from API
* Wrap to 80 columns
* Make more robust by checking for command success
|
| | | |
|
| |/
|
|
| |
Reflects the changes in 7a7eca52019bf21d21cdffcf03cd9c5eacd8363b
|
| |
|
|
|
|
|
|
|
| |
If memory swapping was enabled locally, the memory test would fail.
Explicitly disabling swapping also removes reliance on the assumption
that it'll be disabled in production.
* Add a constant for the maximum memory
* Simplify the timeout test; it'd otherwise first run out of memory now
|
| |
|
|
|
|
| |
* Mount volume to the same path as the source directory on the host
* Keep the container up in the background so it doesn't have to be
restarted or the ownership fix
|
| |
|
|
|
|
| |
When coverage runs in a container, it is ran under root so the resulting
coverage file is owned by root. chown is used to change ownership to
be the same as the folder it is in.
|
| |
|
|
| |
* Put scripts in a new scripts folder
|
| |
|
|
|
| |
This PR is to add CI settings to master and to test the PR CI pipeline.
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
Sebastiaan Zeeff
MarkKoz
scragly
Johannes Christ
Christopher Baklid