agw/overleaf-cep
1
0
Fork 0
mirror of https://github.com/yu-i-i/overleaf-cep.git synced 2026-05-23 17:19:37 +02:00
Code Issues Packages Projects Releases Wiki Activity

[clsi] merge sandboxed compiles config from Server Pro and SaaS (#25062)

Browse Source 
* [clsi] merge sandboxed compiles config from Server Pro and SaaS

* [clsi] reorder fallback env vars

Co-authored-by: Mathew Evans <matt.evans@overleaf.com>

* [server-pro] bump version of expected release with these changes

---------

Co-authored-by: Mathew Evans <matt.evans@overleaf.com>
GitOrigin-RevId: bada93fec89bcc3f2bab85b6e60b2e27de88b9c2
This commit is contained in:
Jakob Ackermann
2025-04-25 11:03:38 +02:00
committed by Copybot
parent 9aa41ae1d8
commit fdf6c0f9fb
4 changed files with 25 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
docker-compose.yml
View File

@@ -75,11 +75,13 @@ services:
## Sandboxed Compiles: https://github.com/overleaf/overleaf/wiki/Server-Pro:-Sandboxed-Compiles
SANDBOXED_COMPILES: 'true'
SANDBOXED_COMPILES_SIBLING_CONTAINERS: 'true'
### Bind-mount source for /var/lib/overleaf/data/compiles inside the container.
SANDBOXED_COMPILES_HOST_DIR_COMPILES: '/home/user/sharelatex_data/data/compiles'
### Bind-mount source for /var/lib/overleaf/data/output inside the container.
SANDBOXED_COMPILES_HOST_DIR_OUTPUT: '/home/user/sharelatex_data/data/output'
### Backwards compatibility (before Server Pro 5.5)
DOCKER_RUNNER: 'true'
SANDBOXED_COMPILES_SIBLING_CONTAINERS: 'true'
## Works with test LDAP server shown at bottom of docker compose
# OVERLEAF_LDAP_URL: 'ldap://ldap:389'

7
server-ce/test/host-admin.js
View File

@@ -131,9 +131,7 @@ const allowedVars = Joi.object(
'GIT_BRIDGE_HOST',
'GIT_BRIDGE_PORT',
'V1_HISTORY_URL',
'DOCKER_RUNNER',
'SANDBOXED_COMPILES',
'SANDBOXED_COMPILES_SIBLING_CONTAINERS',
'ALL_TEX_LIVE_DOCKER_IMAGE_NAMES',
'OVERLEAF_TEMPLATES_USER_ID',
'OVERLEAF_NEW_PROJECT_TEMPLATE_LINKS',
@@ -196,10 +194,7 @@ function setVarsDockerCompose({ pro, vars, version, withDataDir }) {
)
}
if (
cfg.services.sharelatex.environment
.SANDBOXED_COMPILES_SIBLING_CONTAINERS === 'true'
) {
if (cfg.services.sharelatex.environment.SANDBOXED_COMPILES === 'true') {
cfg.services.sharelatex.environment.SANDBOXED_COMPILES_HOST_DIR =
PATHS.SANDBOXED_COMPILES_HOST_DIR
cfg.services.sharelatex.environment.TEX_LIVE_DOCKER_IMAGE =

2
server-ce/test/sandboxed-compiles.spec.ts
View File

@@ -10,9 +10,7 @@ const LABEL_TEX_LIVE_VERSION = 'TeX Live version'
describe('SandboxedCompiles', function () {
const enabledVars = {
DOCKER_RUNNER: 'true',
SANDBOXED_COMPILES: 'true',
SANDBOXED_COMPILES_SIBLING_CONTAINERS: 'true',
ALL_TEX_LIVE_DOCKER_IMAGE_NAMES: '2023,2022',
}

25
services/clsi/config/settings.defaults.js
View File

@@ -98,14 +98,15 @@ if (process.env.ALLOWED_COMPILE_GROUPS) {
}
}
if (process.env.DOCKER_RUNNER) {
let seccompProfilePath
if ((process.env.DOCKER_RUNNER || process.env.SANDBOXED_COMPILES) === 'true') {
module.exports.clsi = {
dockerRunner: process.env.DOCKER_RUNNER === 'true',
dockerRunner: true,
docker: {
runtime: process.env.DOCKER_RUNTIME,
image:
process.env.TEXLIVE_IMAGE || 'quay.io/sharelatex/texlive-full:2017.1',
process.env.TEXLIVE_IMAGE ||
process.env.TEX_LIVE_DOCKER_IMAGE ||
'quay.io/sharelatex/texlive-full:2017.1',
env: {
HOME: '/tmp',
CLSI: 1,
@@ -142,6 +143,7 @@ if (process.env.DOCKER_RUNNER) {
process.exit(1)
}
let seccompProfilePath
try {
seccompProfilePath = Path.resolve(__dirname, '../seccomp/clsi-profile.json')
module.exports.clsi.docker.seccomp_profile = JSON.stringify(
@@ -177,7 +179,22 @@ if (process.env.DOCKER_RUNNER) {
module.exports.path.synctexBaseDir = () => '/compile'
module.exports.path.sandboxedCompilesHostDirCompiles =
process.env.SANDBOXED_COMPILES_HOST_DIR_COMPILES ||
process.env.SANDBOXED_COMPILES_HOST_DIR ||
process.env.COMPILES_HOST_DIR
if (!module.exports.path.sandboxedCompilesHostDirCompiles) {
throw new Error(
'SANDBOXED_COMPILES enabled, but SANDBOXED_COMPILES_HOST_DIR_COMPILES not set'
)
}
module.exports.path.sandboxedCompilesHostDirOutput =
process.env.SANDBOXED_COMPILES_HOST_DIR_OUTPUT ||
process.env.OUTPUT_HOST_DIR
if (!module.exports.path.sandboxedCompilesHostDirOutput) {
// TODO(das7pad): Enforce in a future major version of Server Pro.
// throw new Error(
// 'SANDBOXED_COMPILES enabled, but SANDBOXED_COMPILES_HOST_DIR_OUTPUT not set'
// )
}
}