Codejail Tutor plugin - MVP #1

ericfab179 · 2021-06-01T14:01:35Z

This is the first functional version of a tutor plugin that allows running Codejail using an additional REST API service that runs in a separate container than the edx-platform one.

…ejailservice and sandbox).

…tualenv is a binary an not a symlink (Required by AppArmor). Add sandbox user and install sudo, so sandbox code run without root permissions.

Add sandbox as codejail user.

Add codejail_apparmmor image to run an init job that creates the AppArmor profile on the host. Add lms patches to set additional settings. Update/fix codejail service settings. Set codejail processes limits to 0 (disable) to avoid errors while running jailed code.

regisb · 2021-06-01T14:39:08Z

tutorcodejail/templates/codejail/apps/profiles/docker-edx-sandbox

+  /sandbox/venv/bin/python Cx -> child,
+  profile child flags=(attach_disconnected,mediate_deleted){
+    #include <abstractions/base>
+    #include <abstractions/python>


This will only work if the same python version is installed on the host as in the container. I'm afraid we need to copy-paste the contents of this file into this template.

@regisb This is the content of that file in my host:

/usr/lib{,32,64}/python{2.[4-7],3.[0-9]}/**.{pyc,so} mr, /usr/lib{,32,64}/python{2.[4-7],3.[0-9]}/**.{egg,py,pth} r, /usr/lib{,32,64}/python{2.[4-7],3.[0-9]}/{site,dist}-packages/ r, /usr/lib{,32,64}/python3.[0-9]/lib-dynload/*.so mr, /usr/local/lib{,32,64}/python{2.[4-7],3,3.[0-9]}/**.{pyc,so} mr, /usr/local/lib{,32,64}/python{2.[4-7],3,3.[0-9]}/**.{egg,py,pth} r, /usr/local/lib{,32,64}/python{2.[4-7],3,3.[0-9]}/{site,dist}-packages/ r, /usr/local/lib{,32,64}/python3.[0-9]/lib-dynload/*.so mr, # Site-wide configuration /etc/python{2.[4-7],3.[0-9]}/** r, # shared python paths /usr/share/{pyshared,pycentral,python-support}/** r, /{var,usr}/lib/{pyshared,pycentral,python-support}/** r, /usr/lib/{pyshared,pycentral,python-support}/**.so mr, /var/lib/{pyshared,pycentral,python-support}/**.pyc mr, /usr/lib/python3/dist-packages/**.so mr, # wx paths /usr/lib/wx/python/*.pth r, # python build configuration and headers /usr/include/python{2.[4-7],3.[0-9]}*/pyconfig.h r,

I checked those paths in the codejailservice container and any of them actually exists, I think it is because I am using pyenv. Can we just then get rid of this ?

The thing is that you cannot add #include <abstractions/python> to "docker-edx-sandbox" because you do not know which Python versions are installed on the host, and whether that file is even there. On my Ubuntu 20.04 computer, the /etc/apparmor.d/abstractions/python file is shipped with the apparmor Debian package and the library path regular expressions match Python version from 2.4 to 3.9. But on my Debian 4.9 server the /etc/apparmor.d/abstractions/python file is not even there. If it were there, it might not include support for Python 3.8.

So you need to copy-paste the contents of this file and to change the paths such that it matches the paths for the pyenv-installed python in the Docker container.

regisb · 2021-06-01T14:45:04Z

tutorcodejail/templates/codejail/build/codejail/Dockerfile

+WORKDIR /var/tmp
+RUN mkdir -p common/lib/
+RUN svn export https://github.com/edx/edx-platform.git/tags/open-release/koa.3/common/lib/sandbox-packages common/lib/sandbox-packages
+RUN svn export https://github.com/edx/edx-platform.git/tags/open-release/koa.3/common/lib/symmath common/lib/symmath


What does svn export do? Do we really need subversion or can we get rid of it? If we just to copy a file from edx-platform, it would be safer to COPY it from the docker image labeled DOCKER_IMAGE_OPENEDX.

You are right, it is a good idea to copy it from the edx-platform image, I am going to try that.

regisb · 2021-06-01T14:46:59Z

tutorcodejail/templates/codejail/apps/settings/tutor.py

+    "limit_overrides": {},
+}
+
+apply_django_settings(CODE_JAIL)


Unless I'm mistaken, creating a Django project would require defining a database. A full Django project seems overkill for what you are trying to achieve here, meaning a stateless python interpreter with a very basic API. Can I suggest relying on a more lightweight framework instead, such as Flask?

Get sandbox requirements form openedx edxapp image.

Add codejail service version as variable.

ericfab179 · 2021-07-22T00:33:50Z

tutorcodejail/templates/codejail/build/codejail/Dockerfile

+WORKDIR /openedx/codejailservice
+
+EXPOSE 8000
+CMD gunicorn --workers=2 --name codejailservice --bind=0.0.0.0:8000 --max-requests=1000 codejailservice.wsgi:application


@NeOneSoft please change here to use uwsgi instead of gunicorn

Fix codejail service default host.

regisb · 2021-09-09T13:47:47Z

tutorcodejail/plugin.py

+        "DOCKER_IMAGE": f"docker.io/ednxops/codejailservice:{__version__}",
+    },
+    "set":{
+        "SANDBOX_PYTHON_VERSION": "3.5.10",


I suggest moving this to the "defaults" section. Then, use it as CODEJAIL_SANDBOX_PYTHON_VERSION. When possible, we should really try to avoid "set" entries. They are only required to override existing tutor settings.

regisb · 2021-09-09T13:49:28Z

tutorcodejail/plugin.py

+hooks = {
+    "build-image": {
+        "codejail": "{{ CODEJAIL_DOCKER_IMAGE }}",
+        "codejail_apparmor": "docker.io/ednxops/codejail_apparmor:latest"


I suggest to replace ":latest" by the actual plugin version. This guarantees that the Docker image is always pinned. This is why I always add a "VERSION" setting. See for instance: https://github.com/overhangio/tutor-mfe/blob/932f2db9fdf4c9370abeec5e89a558d9f590f133/tutormfe/plugin.py#L13

regisb · 2021-09-09T13:51:48Z

tutorcodejail/templates/codejail/build/codejail/Dockerfile

+RUN mkdir -p common/lib/
+
+COPY --from={{ DOCKER_IMAGE_OPENEDX }} /openedx/edx-platform/common/lib/sandbox-packages common/lib/sandbox-packages
+COPY --from={{ DOCKER_IMAGE_OPENEDX }} /openedx/edx-platform/common/lib/sandbox-packages common/lib/symmath


Is this a copy-paste typo? Shouldn't it be:

COPY --from={{ DOCKER_IMAGE_OPENEDX }} /openedx/edx-platform/common/lib/symmath common/lib/symmath

?

regisb · 2021-09-09T13:52:48Z

tutorcodejail/templates/codejail/build/codejail/Dockerfile

@@ -0,0 +1,87 @@
+FROM docker.io/ubuntu:20.04 as minimal
+MAINTAINER Overhang.io <contact@overhang.io>


You should change this if you intend to support this image :)

regisb · 2021-09-09T13:54:39Z

tutorcodejail/templates/codejail/build/codejail/Dockerfile

+
+ARG SANDBOX_PYTHON_VERSION={{ SANDBOX_PYTHON_VERSION }}
+RUN $PYENV_ROOT/bin/pyenv install $SANDBOX_PYTHON_VERSION
+


In the future, I think that all code below this line should be run as a different user (e.g: USER openedx). This is important for people running Docker containers in unprivileged environments (as is often the case in Kubernetes). It's not a deal-breaker for this first release, but you should this in mind for the future.

regisb · 2021-09-09T14:28:46Z

tutorcodejail/patches/local-docker-compose-services

+codejailservice:
+  image: {{ CODEJAIL_DOCKER_IMAGE }}
+  environment:
+    FLASK_APP_SETTINGS: config.DevelopmentConfig


Don't we want production settings here instead?

regisb · 2021-09-09T14:29:34Z

tutorcodejail/patches/local-docker-compose-dev-services

+    FLASK_ENV: development
+    FLASK_APP_SETTINGS: codejailservice.config.DevelopmentConfig
+  ports:
+    - "8550:8550"


add: restart: unless-stopped.

regisb · 2021-09-09T14:30:08Z

tutorcodejail/templates/codejail/apps/config/tutor.py

@@ -0,0 +1,7 @@
+from base import BaseConfig
+
+    class DevConfig(BaseConfig):


The indentation looks funky here.

felipemontoya · 2021-10-01T23:44:34Z

I tested this today using an "august" version of edx-platform with the changes of https://github.com/edx/edx-platform/pull/27795 and it worked as a POC.

I think we should merge this as is and iterate on improving the QA and documentation and fixes that come along as we find them.

Having this in the PR is making it more complicated for people just looking at this now.

felipemontoya · 2021-10-01T23:46:58Z

tutorcodejail/templates/codejail/apps/config/tutor.py

+    class DevConfig(BaseConfig):
+        pass
+
+    class ProductionConfig(BaseConfig)


Syntax missing a :

ericfab179 added 6 commits June 1, 2021 08:55

feat: Cookiecutter + initial settings and patches

65993ed

Add settings and configura dockerfile to run two different venvs (cod…

0d94906

…ejailservice and sandbox).

Install sandbox virtualenv using copies, so the python inside the vir…

e3aa9f6

…tualenv is a binary an not a symlink (Required by AppArmor). Add sandbox user and install sudo, so sandbox code run without root permissions.

Add lms feature and setting.

5efde16

Add sandbox as codejail user.

Fix repo url.

eda975f

ericfab179 marked this pull request as draft June 1, 2021 14:02

regisb reviewed Jun 1, 2021

View reviewed changes

ericfab179 added 3 commits June 2, 2021 14:57

Adress PR comment.

8b71349

Get sandbox requirements form openedx edxapp image.

Add sandbox python version as variable.

4c01860

Add codejail service version as variable.

Adjust plugin to work with flask.

b885745

ericfab179 commented Jul 22, 2021

View reviewed changes

ericfab179 added 2 commits August 1, 2021 14:44

Include python abstractions adapted to pyenv in app armor profile.

2b3cc68

Fix codejail service default host.

Replace gunicorn by uwsgi to match edx-platofrm configuration.

011eb8d

ericfab179 changed the title ~~[WIP] Codejail Tutor plugin - MVP~~ Codejail Tutor plugin - MVP Aug 1, 2021

ericfab179 marked this pull request as ready for review August 1, 2021 23:42

ericfab179 requested review from NeOneSoft, felipemontoya and jfavellar90 August 1, 2021 23:43

ericfab179 mentioned this pull request Aug 9, 2021

[Tutor] Codejail plugin should be ready for Maple openedx/wg-build-test-release#98

Closed

ericfab179 added 2 commits August 23, 2021 22:45

Add settings to run ir using tutor dev env.

f085ef2

Upgrade version.

5a772c6

ericfab179 force-pushed the eric/mvp branch from 6aa9ee8 to 5a772c6 Compare August 24, 2021 04:12

regisb reviewed Sep 9, 2021

View reviewed changes

felipemontoya reviewed Oct 1, 2021

View reviewed changes

felipemontoya approved these changes Oct 1, 2021

View reviewed changes

Address Regis PR comments

02c0c79

ericfab179 force-pushed the eric/mvp branch from 9c9822d to 02c0c79 Compare October 1, 2021 23:48

ericfab179 merged commit 93072c5 into main Oct 3, 2021

		@@ -0,0 +1,87 @@
		FROM docker.io/ubuntu:20.04 as minimal
		MAINTAINER Overhang.io <contact@overhang.io>


		ARG SANDBOX_PYTHON_VERSION={{ SANDBOX_PYTHON_VERSION }}
		RUN $PYENV_ROOT/bin/pyenv install $SANDBOX_PYTHON_VERSION

		@@ -0,0 +1,7 @@
		from base import BaseConfig

		class DevConfig(BaseConfig):

Codejail Tutor plugin - MVP #1

Codejail Tutor plugin - MVP #1

Uh oh!

Conversation

ericfab179 commented Jun 1, 2021

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ericfab179 Jul 22, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

regisb Sep 9, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

felipemontoya commented Oct 1, 2021

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ericfab179 Jul 22, 2021 •

edited

Loading

regisb Sep 9, 2021 •

edited

Loading