Refactor Sandboxed Compiles

server-ce/config/settings.js

@@ -498,35 +498,6 @@ if (
   )
 }
 
-// Overleaf Extended CE Compiler options to enable sandboxed compiles.
-// -----------
-if (process.env.SANDBOXED_COMPILES === 'true') {
-  settings.clsi = {
-    ...settings.clsi,
-    dockerRunner: true,
-    docker: {
-      image: process.env.TEX_LIVE_DOCKER_IMAGE,
-      user:  process.env.TEX_LIVE_DOCKER_USER || 'www-data',
-    }
-  }
-
-  if (settings.path == null) {
-    settings.path = {}
-  }
-  settings.path.synctexBaseDir = () => '/compile'
-  if (process.env.SANDBOXED_COMPILES_SIBLING_CONTAINERS === 'true') {
-    console.log('Using sibling containers for sandboxed compiles')
-    if (process.env.SANDBOXED_COMPILES_HOST_DIR) {
-      settings.path.sandboxedCompilesHostDir =
-        process.env.SANDBOXED_COMPILES_HOST_DIR
-    } else {
-      console.error(
-        'Sibling containers, but SANDBOXED_COMPILES_HOST_DIR not set'
-      )
-    }
-  }
-}
-
 // With lots of incoming and outgoing HTTP connections to different services,
 // sometimes long running, it is a good idea to increase the default number
 // of sockets that Node will hold open.

services/clsi/config/settings.defaults.cjs

@@ -151,7 +151,7 @@ if ((process.env.DOCKER_RUNNER || process.env.SANDBOXED_COMPILES) === 'true') {
         CLSI: 1,
       },
       socketPath: '/var/run/docker.sock',
-      user: process.env.TEXLIVE_IMAGE_USER || 'tex',
+      user: process.env.TEXLIVE_IMAGE_USER || 'www-data',
     },
     optimiseInDocker: true,
     expireProjectAfterIdleMs: 24 * 60 * 60 * 1000,

services/web/config/settings.defaults.js

@@ -1096,6 +1096,7 @@ module.exports = {
     'launchpad',
     'server-ce-scripts',
     'user-activate',
+    'sandboxed-compiles',
     'symbol-palette',
     'track-changes',
     'authentication/ldap',
@@ -1131,15 +1132,6 @@ module.exports = {
 
   enablePandocConversions: process.env.ENABLE_PANDOC_CONVERSIONS === 'true',
 
-  allowedImageNames: process.env.SANDBOXED_COMPILES === 'true'
-    ? parseTextExtensions(process.env.ALL_TEX_LIVE_DOCKER_IMAGES)
-        .map((imageName, index) => ({
-          imageName,
-          imageDesc: parseTextExtensions(process.env.ALL_TEX_LIVE_DOCKER_IMAGE_NAMES)[index]
-            || imageName.split(':')[1],
-        }))
-    : undefined,
-
   oauthProviders: {
     ...(process.env.EXTERNAL_AUTH && process.env.EXTERNAL_AUTH.includes('oidc') && {
       [process.env.OVERLEAF_OIDC_PROVIDER_ID || 'oidc']: {

services/web/modules/sandboxed-compiles/index.mjs

@@ -0,0 +1,22 @@
+import Settings from '@overleaf/settings'
+
+const parseTextExtensions = function (extensions) {
+  if (extensions) {
+    return extensions.split(',').map(ext => ext.trim())
+  } else {
+    return []
+  }
+}
+
+if (process.env.SANDBOXED_COMPILES === 'true') {
+  Settings.allowedImageNames = parseTextExtensions(process.env.ALL_TEX_LIVE_DOCKER_IMAGES)
+    .map((imageName, index) => ({
+      imageName,
+      imageDesc: parseTextExtensions(process.env.ALL_TEX_LIVE_DOCKER_IMAGE_NAMES)[index]
+        || imageName.split(':')[1],
+    }))
+  if(!process.env.TEX_LIVE_DOCKER_IMAGE) {
+    process.env.TEX_LIVE_DOCKER_IMAGE = Settings.allowedImageNames[0].imageName
+  }
+  Settings.currentImageName = process.env.TEX_LIVE_DOCKER_IMAGE
+}