blob: 6b22182d2c04db450533340906fcee57a792999c [file] [log] [blame] [raw]
name: "compiler explorer compilation/tool sandbox"
mode: ONCE
hostname: "ce"
time_limit: 0
log_level: FATAL
rlimit_as_type: INF
rlimit_cpu_type: SOFT
rlimit_fsize: 1024 # 1GB
rlimit_nofile: 100
uidmap {
inside_id: "10240"
}
gidmap {
inside_id: "10240"
}
# must run following as root during system startup
# cgcreate -a ubuntu:ubuntu -g memory,pids,cpu,net_cls:ce-compile
cgroup_mem_parent: "ce-compile"
cgroup_pids_parent: "ce-compile"
cgroup_net_cls_parent: "ce-compile"
cgroup_cpu_parent: "ce-compile"
cgroup_mem_max: 1342177280 # 1.25 GiB
cgroup_pids_max: 64 # go uses a bunch (probably one per CPU, on my desktop)
cgroup_cpu_ms_per_sec: 1000
mount {
src: "/bin"
dst: "/bin"
is_bind: true
}
mount {
src: "/lib"
dst: "/lib"
is_bind: true
}
mount {
src: "/usr"
dst: "/usr"
is_bind: true
}
mount {
src: "/etc/localtime"
dst: "/etc/localtime"
is_bind: true
}
mount {
src_content: "nobody:x:65534:65534:Not root:/root:/none\nce:x:10240:10240:Not a real account:/app:/bin/bash"
dst: "/etc/passwd"
is_bind: true
}
mount {
src_content: "nogroup:x:65534:\n\nce:x:10240:"
dst: "/etc/group"
is_bind: true
}
mount {
# this password hash is here intentionally, and is not actually used for anything
src_content: "ce:$1$rockyou$hty8SH9lK4mcCQXKENxaa1:18723:0:99999:7:::"
dst: "/etc/shadow"
is_bind: true
}
# Mounting ld.so.conf* is needed to get the magic that lets pthread be found by libc.
# See https://github.com/compiler-explorer/compiler-explorer/issues/2611
mount {
src: "/etc/ld.so.conf.d"
dst: "/etc/ld.so.conf.d"
is_bind: true
}
mount {
src: "/etc/ld.so.conf"
dst: "/etc/ld.so.conf"
is_bind: true
}
mount {
src: "/lib64"
dst: "/lib64"
is_bind: true
mandatory: false
}
mount {
src: "/lib32"
dst: "/lib32"
is_bind: true
mandatory: false
}
mount {
dst: "/tmp"
fstype: "tmpfs"
options: "size=134217728,nr_inodes=1000" # 128MiB
rw: true
noexec: true
nodev: true
nosuid: true
}
mount {
src: "/dev/null"
dst: "/dev/null"
rw: true
is_bind: true
}
mount {
src: "/dev/zero"
dst: "/dev/zero"
is_bind: true
}
mount {
src: "/dev/urandom"
dst: "/dev/random"
is_bind: true
}
mount {
src: "/dev/urandom"
dst: "/dev/urandom"
is_bind: true
}
mount {
dst: "/proc"
fstype: "proc"
}
mount {
src: "/opt/compiler-explorer"
dst: "/opt/compiler-explorer"
is_bind: true
}
# Needed for icc
mount {
src: "/opt/intel"
dst: "/opt/intel"
is_bind: true
mandatory: false
}
# Needed for ARM non-free compilers
mount {
src: "/opt/arm"
dst: "/opt/arm"
is_bind: true
mandatory: false
}
# Needed for things with shim scripts e.g. Python
mount {
src: "/infra/.deploy/etc/scripts"
dst: "/infra/.deploy/etc/scripts"
is_bind: true
mandatory: false
}