mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-26 06:52:57 +08:00
John Myers
b1b5d90275
The sandbox now automatically creates directories listed in the policy's `read_write` section and sets ownership to the configured sandbox user/group. This runs in the supervisor process before forking the child. Previously, read_write directories had to be pre-created in the Dockerfile with correct ownership. Now arbitrary paths can be added to the policy and they will be prepared at runtime. Also adds a hardcoded chown for /sandbox in Dockerfile.factory as a belt-and-suspenders approach for the default case.
83 lines
2.4 KiB
Docker
83 lines
2.4 KiB
Docker
# syntax=docker/dockerfile:1.4
|
|
# Supervisor container for navigator
|
|
# Multi-stage build for smaller final image
|
|
|
|
# Stage 1: Rust builder
|
|
FROM rust:1.88-slim AS rust-builder
|
|
ARG RUST_BUILD_PROFILE=debug
|
|
|
|
# Install build dependencies for protobuf-src
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
cmake \
|
|
g++ \
|
|
make \
|
|
protobuf-compiler \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /build
|
|
COPY Cargo.toml Cargo.lock ./
|
|
COPY crates/ crates/
|
|
COPY proto/ proto/
|
|
RUN --mount=type=cache,target=/usr/local/cargo/registry \
|
|
--mount=type=cache,target=/build/target \
|
|
if [ "$RUST_BUILD_PROFILE" = "release" ]; then \
|
|
cargo build --release --package navigator-sandbox; \
|
|
else \
|
|
cargo build --package navigator-sandbox; \
|
|
fi && \
|
|
mkdir -p /build/out && \
|
|
cp /build/target/${RUST_BUILD_PROFILE}/navigator-sandbox /build/out/
|
|
|
|
# Stage 2: Python base
|
|
FROM python:3.12-slim AS base
|
|
|
|
# Set environment variables
|
|
ENV PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1
|
|
|
|
WORKDIR /sandbox
|
|
|
|
# Install system dependencies
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
curl \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Create supervisor and sandbox users/groups
|
|
RUN groupadd -r supervisor && useradd -r -g supervisor -s /usr/sbin/nologin supervisor && \
|
|
groupadd -r sandbox && useradd -r -g sandbox -s /usr/sbin/nologin sandbox
|
|
|
|
# Stage 3: Python dependencies builder
|
|
FROM base AS builder
|
|
|
|
# Install uv
|
|
COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
|
|
|
|
# Install dependencies into a virtual environment
|
|
RUN uv venv /app/.venv && \
|
|
uv sync --frozen --no-dev --no-install-project 2>/dev/null || \
|
|
uv sync --no-dev --no-install-project 2>/dev/null || true
|
|
|
|
# Stage 4: Final image
|
|
FROM base AS final
|
|
ARG RUST_BUILD_PROFILE=debug
|
|
|
|
# Copy Python virtual environment and uv
|
|
COPY --from=builder /app/.venv /app/.venv
|
|
COPY --from=builder /usr/local/bin/uv /usr/local/bin/uv
|
|
|
|
# Copy navigator-sandbox binary from Rust builder
|
|
COPY --from=rust-builder /build/out/navigator-sandbox /usr/local/bin/
|
|
|
|
# Add venv to PATH
|
|
ENV PATH="/app/.venv/bin:$PATH"
|
|
|
|
# Create policy mount location, sandbox workspace, and log file
|
|
RUN mkdir -p /var/navigator /sandbox /var/log && \
|
|
touch /var/log/navigator.log && \
|
|
chown supervisor:supervisor /var/log/navigator.log && \
|
|
chmod 0664 /var/log/navigator.log && \
|
|
chown sandbox:sandbox /sandbox
|
|
|
|
# Set navigator-sandbox as the entrypoint
|
|
ENTRYPOINT ["navigator-sandbox"]
|