Skip to content

Commit 09629aa

Browse files
MoisesGSalasMoisesGSalas
committed
feat!: add support for the Ulmo release
This changes also include support for openedx/codejail-service as an alternative implementation of the safe_exec REST API.
1 parent 24352f2 commit 09629aa

File tree

17 files changed

+537
-92
lines changed

17 files changed

+537
-92
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ jobs:
1616
runs-on: ubuntu-latest
1717
strategy:
1818
matrix:
19-
python-version: ['3.9', '3.12']
19+
python-version: ['3.10', '3.12']
2020

2121
steps:
2222
- uses: actions/checkout@v4

‎README.rst‎

Lines changed: 25 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,18 @@
11
Codejail plugin for `Tutor`_
22
============================
33

4-
Tutor plugin that configures and runs a `Codejail Service`_ using a REST API. `Codejail`_ allows for the
5-
secure execution of untrusted code within sandboxes, providing a safe environment for running potentially dangerous code.
4+
Tutor plugin that configures and runs a `Codejail Service`_ using a REST API.
5+
`Codejail`_ allows for the secure execution of untrusted code within sandboxes,
6+
providing a safe environment for running potentially dangerous code.
7+
8+
Starting from the Ulmo release, the codejail plugin is transitioning to an
9+
alternative implementation of the safe-exec API ( `_Codejail Service V2`_).
10+
You can opt-in to use this new implementation on Ulmo before it finally becomes
11+
the default on the Verawood release.
612

713
.. _Tutor: https://docs.tutor.overhang.io
814
.. _Codejail Service: https://github.com/eduNEXT/codejailservice
15+
.. _Codejail Service V2: https://github.com/openedx/codejail-service
916
.. _Codejail: https://github.com/openedx/codejail
1017

1118
Installation
@@ -23,9 +30,9 @@ You can install a specific version by adding the tag, branch, or commit:
2330

2431
.. code-block:: bash
2532
26-
pip install tutor-contrib-codejail==v20.0.0
33+
pip install tutor-contrib-codejail~=21.0
2734
# or install from the source
28-
pip install git+https://github.com/edunext/tutor-contrib-codejail@v20.0.0
35+
pip install git+https://github.com/edunext/tutor-contrib-codejail@v21.0.0
2936
3037
Usage
3138
-----
@@ -55,14 +62,26 @@ Configuration
5562
To customize the configuration, update the following settings in Tutor:
5663

5764
- ``CODEJAIL_APPARMOR_DOCKER_IMAGE``: (default: ``docker.io/ednxops/codejail_apparmor_loader:latest``)
65+
- ``CODEJAIL_DOCKER_IMAGE_V2`` : (default: ``{{ CODEJAIL_DOCKER_IMAGE }}-v2``)
5866
- ``CODEJAIL_DOCKER_IMAGE``: (default: ``docker.io/ednxops/codejailservice:{{__version__}}``)
5967
- ``CODEJAIL_ENABLE_K8S_DAEMONSET`` (default: ``False``)
6068
- ``CODEJAIL_ENFORCE_APPARMOR`` (default: ``True``)
6169
- ``CODEJAIL_EXTRA_PIP_REQUIREMENTS`` (default: ``[]``)
6270
- ``CODEJAIL_SANDBOX_PYTHON_VERSION`` (default: ``3.11.9``)
63-
- ``CODEJAIL_SERVICE_REPOSITORY`` (default ``https://github.com/edunext/codejailservice.git```)
64-
- ``CODEJAIL_SERVICE_VERSION`` (default: ``release/teak.1``),
71+
- ``CODEJAIL_SERVICE_REPOSITORY`` (default: ``https://github.com/edunext/codejailservice.git```)
72+
- ``CODEJAIL_SERVICE_VERSION`` (default: ``{{ OPENEDX_COMMON_VERSION }}``),
6573
- ``CODEJAIL_SKIP_INIT`` (default: ``False``)
74+
- ``SERVICE_V2_REPOSITORY``: (default: ``https://github.com/openedx/codejail-service.git``)
75+
- ``SERVICE_V2_VERSION``: (default: ``{{ OPENEDX_COMMON_VERSION }}``)
76+
- ``USE_SERVICE_V2``: (default: ``False``)
77+
78+
The ``CODEJAIL_V2_*`` settings are meant to be used only during the Ulmo
79+
release and will be phased-out during the Verawood release.
80+
81+
To opt-in to the new implementation of the code-exec API set ``USE_SERVICE_V2``
82+
to ``True`` and re-deploy your environment. If you are using a a custom image
83+
for the codejail service you will need to rebuild it with ``USE_SERVICE_V2``
84+
set to ``True`.
6685
6786
Custom Image
6887
~~~~~~~~~~~~

‎setup.py‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -43,17 +43,15 @@ def load_about():
4343
long_description=load_readme(),
4444
packages=find_packages(exclude=["tests*"]),
4545
include_package_data=True,
46-
python_requires=">=3.8",
47-
install_requires=["tutor>=20.0.0,<21"],
46+
python_requires=">=3.10",
47+
install_requires=["tutor~=21.0"],
4848
entry_points={"tutor.plugin.v1": ["codejail = tutorcodejail.plugin"]},
4949
classifiers=[
5050
"Development Status :: 3 - Alpha",
5151
"Intended Audience :: Developers",
5252
"License :: OSI Approved :: GNU Affero General Public License v3",
5353
"Operating System :: OS Independent",
5454
"Programming Language :: Python",
55-
"Programming Language :: Python :: 3.8",
56-
"Programming Language :: Python :: 3.9",
5755
"Programming Language :: Python :: 3.10",
5856
"Programming Language :: Python :: 3.11",
5957
"Programming Language :: Python :: 3.12",

‎tutorcodejail/__about__.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
"""Helps you keep your cool when creating dozens of open edX and eduNEXT environments."""
2-
__version__ = "20.1.0"
2+
__version__ = "21.0.0"

‎tutorcodejail/patches/k8s-deployments‎

Lines changed: 44 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
---
2+
{% if CODEJAIL_USE_SERVICE_V2 %}
23
apiVersion: apps/v1
34
kind: Deployment
45
metadata:
@@ -13,11 +14,49 @@ spec:
1314
metadata:
1415
labels:
1516
app.kubernetes.io/name: codejailservice
16-
annotations:
17-
{% if CODEJAIL_ENFORCE_APPARMOR %}
18-
container.apparmor.security.beta.kubernetes.io/codejailservice: "localhost/docker-edx-sandbox"
19-
{% endif %}
2017
spec:
18+
securityContext:
19+
appArmorProfile:
20+
type: Localhost
21+
localhostProfile: openedx_codejail_service
22+
containers:
23+
- name: codejailservice
24+
image: {{ CODEJAIL_DOCKER_IMAGE_V2 }}
25+
ports:
26+
- containerPort: 8550
27+
env:
28+
- name: DJANGO_SETTINGS_MODULE
29+
value: codejail_service.settings.tutor
30+
volumeMounts:
31+
- mountPath: /app/codejail_service/settings/tutor.py
32+
name: settings-codejail
33+
subPath: tutor.py
34+
volumes:
35+
- name: settings-codejail
36+
configMap:
37+
name: settings-codejail
38+
{% else %}
39+
apiVersion: apps/v1
40+
kind: Deployment
41+
metadata:
42+
name: codejailservice
43+
labels:
44+
app.kubernetes.io/name: codejailservice
45+
spec:
46+
selector:
47+
matchLabels:
48+
app.kubernetes.io/name: codejailservice
49+
template:
50+
metadata:
51+
labels:
52+
app.kubernetes.io/name: codejailservice
53+
spec:
54+
{% if CODEJAIL_ENFORCE_APPARMOR %}
55+
securityContext:
56+
appArmorProfile:
57+
type: Localhost
58+
localhostProfile: docker-edx-sandbox
59+
{% endif %}
2160
containers:
2261
- name: codejailservice
2362
image: {{ CODEJAIL_DOCKER_IMAGE }}
@@ -34,6 +73,7 @@ spec:
3473
- name: settings-codejail
3574
configMap:
3675
name: settings-codejail
76+
{% endif %}
3777
{% if CODEJAIL_ENABLE_K8S_DAEMONSET %}
3878
---
3979
apiVersion: apps/v1

‎tutorcodejail/patches/k8s-services‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ apiVersion: v1
33
kind: Service
44
metadata:
55
name: codejailservice
6+
labels:
7+
app.kubernetes.io/name: codejailservice
68
spec:
79
type: ClusterIP
810
ports:

‎tutorcodejail/patches/kustomization-configmapgenerator‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,17 @@
11
- name: codejail-profile
22
files:
3-
- plugins/codejail/apps/profiles/docker-edx-sandbox
3+
- plugins/codejail/apps/profiles/docker-edx-sandbox.profile
4+
- plugins/codejail/apps/profiles/openedx-codejail-service.profile
45
options:
56
labels:
67
app.kubernetes.io/name: codejail-aa-loader
78
- name: settings-codejail
89
files:
9-
- plugins/codejail/apps/config/tutor.py
10+
{% if CODEJAIL_USE_SERVICE_V2 %}
11+
- plugins/codejail/apps/codejail-service-v2/tutor.py
12+
{% else %}
13+
- plugins/codejail/apps/codejail/tutor.py
14+
{% endif %}
1015
options:
1116
labels:
1217
app.kubernetes.io/name: codejailservice

‎tutorcodejail/patches/local-docker-compose-jobs-services‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
codejail-apparmor-job:
2+
image: {{ CODEJAIL_APPARMOR_DOCKER_IMAGE }}
3+
privileged: true
4+
environment:
5+
SKIP_INIT: "{{ CODEJAIL_SKIP_INIT }}"
6+
volumes:
7+
- ../plugins/codejail/apps/profiles/:/profiles/:ro
8+
- /sys:/sys
9+
- /etc/apparmor.d:/etc/apparmor.d

‎tutorcodejail/patches/local-docker-compose-services‎

Lines changed: 18 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,19 @@
11
#############Codejail service
2+
{% if CODEJAIL_USE_SERVICE_V2 %}
3+
codejailservice:
4+
image: {{ CODEJAIL_DOCKER_IMAGE_V2 }}
5+
ports:
6+
- 8550:8550
7+
environment:
8+
DJANGO_SETTINGS_MODULE: codejail_service.settings.tutor
9+
security_opt:
10+
- apparmor:openedx_codejail_service
11+
volumes:
12+
- ../plugins/codejail/apps/codejail-service-v2/tutor.py:/app/codejail_service/settings/tutor.py:ro
13+
restart: unless-stopped
14+
depends_on:
15+
- codejail-apparmor-loader
16+
{% else %}
217
codejailservice:
318
image: {{ CODEJAIL_DOCKER_IMAGE }}
419
environment:
@@ -8,11 +23,11 @@ codejailservice:
823
- apparmor:docker-edx-sandbox
924
{% endif %}
1025
volumes:
11-
- ../plugins/codejail/apps/config/tutor.py:/openedx/codejailservice/codejailservice/tutor.py:ro
12-
- ../../data/codejail:/openedx/data
26+
- ../plugins/codejail/apps/codejail/tutor.py:/openedx/codejailservice/codejailservice/tutor.py:ro
1327
restart: unless-stopped
1428
depends_on:
1529
- codejail-apparmor-loader
30+
{% endif %}
1631

1732
codejail-apparmor-loader:
1833
image: {{ CODEJAIL_APPARMOR_DOCKER_IMAGE }}
@@ -23,6 +38,6 @@ codejail-apparmor-loader:
2338
- -v=2
2439
- /profiles
2540
volumes:
26-
- ../plugins/codejail/apps/profiles/docker-edx-sandbox:/profiles/docker-edx-sandbox:ro
41+
- ../plugins/codejail/apps/profiles/:/profiles/:ro
2742
- /sys:/sys
2843
- /etc/apparmor.d:/etc/apparmor.d

0 commit comments

Comments
 (0)