Skip to content

Improve isolation #79

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
christophdb merged 3 commits into from
May 12, 2025
Merged

Improve isolation #79

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f2fc713
Attach container to custom network with disabled ICC
simonhammes May 12, 2025
c372458
Allow mounting root filesystem as read-only
simonhammes May 12, 2025
059957e
Fix code style
simonhammes May 12, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 17 additions & 1 deletion starter/runner.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,14 @@
GID = os.environ.get("PYTHON_RUNNER_GID", "")
USER = os.environ.get("PYTHON_RUNNER_USER", "")
GROUP = os.environ.get("PYTHON_RUNNER_GROUP", "")
NETWORK = os.environ.get("PYTHON_RUNNER_NETWORK", "runner-net")
READ_ONLY_FILESYSTEM = (
os.environ.get("PYTHON_RUNNER_READ_ONLY_FILESYSTEM", "false").lower() == "true"
)
# 100MB by default
TMPFS_MOUNT_SIZE_IN_BYTES = os.environ.get(
"PYTHON_RUNNER_TMPFS_MOUNT_SIZE_IN_BYTES", "104857600"
)
OTHER_OPTIONS = os.environ.get("PYTHON_RUNNER_OTHER_OPTIONS", "[]")
try:
OTHER_OPTIONS = ast.literal_eval(OTHER_OPTIONS)
Expand Down Expand Up @@ -268,8 +276,9 @@ def run_python(data):
env_file,
"-v",
"{}:/scripts".format(tmp_dir),
"--network",
NETWORK,
]
logging.debug("command: %s", command)

# timezone, if not set TIME_ZONE in settings then set time zone use timezone_command
if timezone_command:
Expand All @@ -293,6 +302,12 @@ def run_python(data):
user_operation += ":" + str(GID)
if user_operation:
command.extend(["-u", user_operation])
if READ_ONLY_FILESYSTEM:
command.append("--read-only")
# Add tmpfs mount for /tmp (100MB)
command.extend(
["--mount", f"type=tmpfs,dst=/tmp,tmpfs-size={TMPFS_MOUNT_SIZE_IN_BYTES}"]
)
# other options, these options are experimental, may cause failure to start script
if OTHER_OPTIONS and isinstance(OTHER_OPTIONS, list):
for option in OTHER_OPTIONS:
Expand All @@ -307,6 +322,7 @@ def run_python(data):
logging.debug("try to execute this python runner image: %s", PYTHON_RUNNER_IMAGE)
command.append(PYTHON_RUNNER_IMAGE)
command.append("run") # override command
logging.debug("command: %s", command)

start_at = time.time()

Expand Down