Skip to content

Commit d9132ed

Browse files
vtm9vtm9
committed
Fix
1 parent 4a07349 commit d9132ed

5 files changed

Lines changed: 81 additions & 83 deletions

File tree

‎apps/runner/images/csharp/Checker.csproj‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<Project Sdk="Microsoft.NET.Sdk">
22
<PropertyGroup>
33
<OutputType>Exe</OutputType>
4-
<TargetFramework>net9.0</TargetFramework>
4+
<TargetFramework>net10.0</TargetFramework>
55
<RootNamespace>app</RootNamespace>
66
<ImplicitUsings>enable</ImplicitUsings>
77
<Nullable>enable</Nullable>

‎apps/runner/images/csharp/Containerfile‎

Lines changed: 39 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -9,23 +9,23 @@ FROM --platform=$TARGETPLATFORM ${RUNNER_IMAGE} AS runner
99
# ---------- .NET SDK base (Debian/glibc) ----------
1010
FROM --platform=$TARGETPLATFORM mcr.microsoft.com/dotnet/sdk:${DOTNET_TAG}
1111

12-
# We intentionally do NOT set NUGET_PACKAGES or HOME here.
13-
#
14-
# At runtime the runner-zig sandbox force-sets HOME=/sandbox and mounts a
15-
# fresh tmpfs over /tmp per request. Anything we stash under /tmp (e.g. a
16-
# pre-restored package cache) is therefore invisible to user code, which is
17-
# exactly what produced the previous "NU1301: Unable to load the service
18-
# index for source https://api.nuget.org/v3/index.json" error.
19-
#
20-
# Instead we pre-restore into ./.nuget/packages under the workdir. The
21-
# runner's per-request copyWorkspace step then carries the cache into
22-
# /sandbox/.nuget/packages, where dotnet finds it via the default
23-
# $HOME/.nuget/packages lookup — no network needed at request time.
24-
#
25-
# RUN_ENV_ALLOW makes the runner forward the listed DOTNET_* vars into the
26-
# sandbox env. Without DOTNET_SKIP_FIRST_TIME_EXPERIENCE at runtime, dotnet
27-
# prints the "Welcome to .NET" banner and tries to install the HTTPS dev
28-
# cert on every /run.
12+
# We intentionally do NOT set NUGET_PACKAGES or HOME here.
13+
#
14+
# At runtime the runner-zig sandbox force-sets HOME=/sandbox and mounts a
15+
# fresh tmpfs over /tmp per request. Anything stashed under /tmp (e.g. a
16+
# pre-restored package cache) is therefore invisible to user code, which is
17+
# what produced the previous "NU1301: Unable to load the service index for
18+
# source https://api.nuget.org/v3/index.json" error.
19+
#
20+
# Instead we pre-restore into ./.nuget/packages under the workdir. The
21+
# runner's per-request copyWorkspace step then carries the cache into
22+
# /sandbox/.nuget/packages, where dotnet finds it via the default
23+
# $HOME/.nuget/packages lookup — no network needed at request time.
24+
#
25+
# RUN_ENV_ALLOW makes the runner forward the listed DOTNET_* vars into the
26+
# sandbox env. Without DOTNET_SKIP_FIRST_TIME_EXPERIENCE at runtime, dotnet
27+
# prints the "Welcome to .NET" banner and tries to install the HTTPS dev
28+
# cert on every /run.
2929
ENV DOTNET_NOLOGO=1 \
3030
DOTNET_CLI_TELEMETRY_OPTOUT=1 \
3131
DOTNET_SKIP_FIRST_TIME_EXPERIENCE=1 \
@@ -34,42 +34,44 @@ ENV DOTNET_NOLOGO=1 \
3434

3535
WORKDIR /usr/src/app
3636

37-
# System deps
37+
# System deps
3838
RUN apt-get update \
3939
&& apt-get install -y --no-install-recommends make curl ca-certificates \
4040
&& rm -rf /var/lib/apt/lists/*
4141

42-
# Create non-root user + writable workdir. The runner-zig sandbox runs user
43-
# code as RUN_UID_BASE+slot (default 10001+slot); matching that here keeps
44-
# build-time and runtime UIDs aligned.
42+
# Create non-root user + writable workdir. UID matches RUN_UID_BASE+slot
43+
# (default 10001+slot) so build-time and runtime ownership line up.
4544
RUN groupadd -g 10001 -r runneruser \
4645
&& useradd -r -g runneruser -u 10001 -m -d /home/runneruser -s /usr/sbin/nologin runneruser \
4746
&& chown -R runneruser:runneruser /home/runneruser /usr/src/app
4847

4948
USER runneruser
5049

51-
# Keep obj/bin project-local so they live inside /sandbox at runtime. The
52-
# runner's recursive chown gives the slot UID write access to every
53-
# workspace sub-path, so dotnet build can scribble into ./obj freely.
50+
# Keep obj/bin project-local so they live inside /sandbox at runtime. The
51+
# runner's umask=0 + 0o700 slot-owned top-level dir give the slot UID write
52+
# access to every workspace sub-path, so dotnet build can scribble into
53+
# ./obj freely. NuGetAudit=false silences NU1900 warnings — the audit
54+
# endpoint can't be reached from the netns-isolated sandbox.
5455
RUN cat > Directory.Build.props <<'EOF'
55-
<Project>
56-
<PropertyGroup>
57-
<BaseIntermediateOutputPath>obj/</BaseIntermediateOutputPath>
58-
<IntermediateOutputPath>obj/</IntermediateOutputPath>
59-
<BaseOutputPath>bin/</BaseOutputPath>
60-
</PropertyGroup>
61-
</Project>
56+
<Project>
57+
<PropertyGroup>
58+
<BaseIntermediateOutputPath>obj/</BaseIntermediateOutputPath>
59+
<IntermediateOutputPath>obj/</IntermediateOutputPath>
60+
<BaseOutputPath>bin/</BaseOutputPath>
61+
<NuGetAudit>false</NuGetAudit>
62+
</PropertyGroup>
63+
</Project>
6264
EOF
6365

64-
# Restore into the workdir (--packages) so the cache survives the runtime
65-
# workspace copy. Layer order: csproj first for better Docker cache reuse
66-
# when only source files change.
66+
# Restore into the workdir (--packages) so the cache survives the runtime
67+
# workspace copy. Layer order: csproj first for better Docker cache reuse
68+
# when only source files change.
6769
COPY --chown=runneruser:runneruser Checker.csproj ./
6870
RUN dotnet restore --disable-parallel \
69-
--packages /usr/src/app/.nuget/packages \
70-
--source https://api.nuget.org/v3/index.json
71+
--packages /usr/src/app/.nuget/packages \
72+
--source https://api.nuget.org/v3/index.json
7173

72-
# App sources
74+
# App sources
7375
COPY --chown=runneruser:runneruser Program.cs .
7476
COPY --chown=runneruser:runneruser check ./check
7577
COPY --chown=runneruser:runneruser Makefile .

‎apps/runner/images/golang/Containerfile‎

Lines changed: 23 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -7,32 +7,35 @@ FROM --platform=$TARGETPLATFORM golang:${GO_TAG}
77

88
RUN apk add --no-cache make git
99

10-
# create app user with a real home
1110
RUN addgroup -S app -g 10001 \
12-
&& adduser -S -D -H -h /home/app -s /sbin/nologin -G app -u 10001 app \
13-
&& mkdir -p /home/app && chown -R app:app /home/app
14-
15-
# make Go caches/modules writable by the app user
16-
ENV HOME=/home/app \
17-
GOCACHE=/home/app/.cache/go-build \
18-
GOPATH=/home/app/go \
19-
GOMODCACHE=/home/app/go/pkg/mod
20-
21-
RUN mkdir -p "$GOCACHE" "$GOMODCACHE" && chown -R app:app /home/app
11+
&& adduser -S -D -h /home/app -s /sbin/nologin -G app -u 10001 app
12+
13+
# Go caches must be reachable from inside the runner-zig sandbox. The sandbox
14+
# masks /tmp (per-request tmpfs) and /app, and force-sets HOME=/sandbox, so
15+
# anything under /home/app or /tmp disappears at request time. /opt is left
16+
# alone, so we put the caches there and forward the env vars to user code via
17+
# RUN_ENV_ALLOW. 0o777 lets every slot UID write — Go uses its own lockfiles,
18+
# so concurrent writes are safe.
19+
ENV GOCACHE=/opt/go/cache \
20+
GOMODCACHE=/opt/go/mod \
21+
RUN_ENV_ALLOW=GOCACHE,GOMODCACHE
22+
23+
RUN mkdir -p /opt/go/cache /opt/go/mod \
24+
&& chown -R app:app /opt/go \
25+
&& chmod -R 0777 /opt/go
2226

2327
WORKDIR /usr/src/app
28+
COPY --chown=app:app check check
29+
COPY --chown=app:app Makefile .
30+
31+
USER app
2432

25-
# app sources
26-
COPY check check
27-
COPY Makefile .
28-
RUN chown -R app:app /usr/src/app
33+
# Pre-warm the build cache so request-time `go run` reuses compiled stdlib +
34+
# checker objects. Only solution.go (which changes per request) gets re-linked.
35+
# Same explicit-file form as the runtime Makefile so we don't need a go.mod.
36+
RUN go build -o /tmp/_warm ./check/checker.go ./check/solution.go && rm -f /tmp/_warm
2937

30-
# runner binary (ensure path exists and perms are OK)
31-
RUN mkdir -p /runner
3238
COPY --from=runner /app/codebattle_runner /runner/codebattle_runner
33-
RUN chown -R app:app /runner && chmod +x /runner/codebattle_runner
34-
35-
USER app
3639

3740
EXPOSE 4040
3841
ENTRYPOINT ["/runner/codebattle_runner"]

‎apps/runner/images/rust/Containerfile‎

Lines changed: 17 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -7,27 +7,23 @@ FROM --platform=$TARGETPLATFORM rust:${RUST_TAG}
77

88
RUN apk add --no-cache make libc-dev
99

10-
# rustup/cargo state must be reachable from inside the runner-zig sandbox.
11-
# That sandbox shadows /tmp (per-request tmpfs), bind-mounts the workdir to
12-
# /sandbox, force-sets HOME=/sandbox, and strips env down to an allowlist.
13-
#
14-
# - RUSTUP_HOME stays at the rust image default (/usr/local/rustup). /usr is
15-
# not shadowed, so the toolchain remains reachable. Forwarding it via
16-
# RUN_ENV_ALLOW is critical — without it the cargo proxy bails with
17-
# "rustup could not choose a version of cargo to run".
18-
# - CARGO_HOME lives under the workdir so it survives the runtime workspace
19-
# copy. The ENV reassignment below switches it to the /sandbox view that
20-
# the slot UID actually sees at request time.
21-
# - CARGO_TARGET_DIR is left unset on purpose: cargo defaults to ./target,
22-
# which is /usr/src/app/target at build time and /sandbox/target at
23-
# request time. Both are the same files, just under different absolute
24-
# paths in the two namespaces.
10+
# rustup + cargo state under /opt so it survives the sandbox masks (which
11+
# shadow /tmp and /app, force-set HOME=/sandbox, and strip env down to an
12+
# allowlist). /opt and /usr aren't shadowed, so the toolchain stays
13+
# reachable and the pre-built cache survives the per-request workspace copy.
14+
# 0o777 below lets every slot UID write — cargo uses .cargo-lock files so
15+
# concurrent invocations are safe for shared artifacts.
2516
ENV RUSTUP_HOME=/usr/local/rustup \
26-
CARGO_HOME=/usr/src/app/.cargo \
27-
RUN_ENV_ALLOW=RUSTUP_HOME,CARGO_HOME,RUST_BACKTRACE
17+
CARGO_HOME=/opt/cargo \
18+
CARGO_TARGET_DIR=/opt/cargo-target \
19+
RUN_ENV_ALLOW=RUSTUP_HOME,CARGO_HOME,CARGO_TARGET_DIR,RUST_BACKTRACE
20+
21+
RUN mkdir -p /opt/cargo /opt/cargo-target
2822

2923
RUN addgroup -S app -g 10001 \
30-
&& adduser -S -D -H -h /nonexistent -s /sbin/nologin -G app -u 10001 app
24+
&& adduser -S -D -h /home/app -s /sbin/nologin -G app -u 10001 app \
25+
&& chown -R app:app /opt/cargo /opt/cargo-target \
26+
&& chmod -R 0777 /opt/cargo /opt/cargo-target
3127

3228
WORKDIR /usr/src/app
3329
RUN chown app:app /usr/src/app
@@ -38,14 +34,11 @@ COPY --chown=app:app Makefile .
3834

3935
USER app
4036

41-
# Pre-warm the dep cache + target so each /run only recompiles the (tiny)
42-
# solution + checker.
37+
# Pre-build into the shared target dir. Request-time builds only recompile
38+
# the changed file (solution.rs) and re-link the bin.
4339
RUN cargo build
4440

45-
# Switch CARGO_HOME to its runtime view. The workdir is bind-mounted to
46-
# /sandbox per request, so /usr/src/app/.cargo appears at /sandbox/.cargo.
47-
ENV CARGO_HOME=/sandbox/.cargo
41+
COPY --from=runner /app/codebattle_runner /runner/codebattle_runner
4842

4943
EXPOSE 4040
50-
COPY --from=runner /app/codebattle_runner /runner/codebattle_runner
5144
ENTRYPOINT ["/runner/codebattle_runner"]

‎apps/runner/images/rust/Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
test:
2-
cargo run -q --offline --target-dir /tmp/cargo-target
2+
cargo run -q --offline
33

44
.PHONY: test

0 commit comments

Comments
 (0)