Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add steps and files so this tool can be used in a docker container #171

Open
wants to merge 4 commits into
base: main
Choose a base branch
from

Conversation

RichardoC
Copy link

This means folks don't need to install things on their host, and the code execution is restricted from accessing their host

@@ -556,7 +556,7 @@ async def execute_code(code, timeout=10):
if sys.platform == "win32":
command = f'"{activate_script}" && python3 {process_id}.py'
else:
command = f'source "{activate_script}" && python3 {process_id}.py'
command = f'. "{activate_script}" && python3 {process_id}.py'
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Required as the container defaults to sh rather than bash

@rigolepe
Copy link

rigolepe commented Sep 6, 2024

+1
I would like to have this option as well for better isolation from my host system.

This is important, compare the two solutions:

Python virtual environment

  • Any Python code, whether run inside or outside a virtual environment, can still access, read, write, or delete files on your system. A virtual environment does not restrict the filesystem access of the code running within it.
  • Code executed in a virtual environment can run system commands (using modules like os or subprocess) and potentially affect the system by installing packages, modifying configuration files, or interacting with hardware.

Docker container

  • A Docker container's filesystem is completely isolated from the host by default. The code inside the container can only access the container’s internal file system. You can share specific parts of the host's file system with the container using volume mounts, but this must be explicitly configured.
  • This isolation makes it much harder for code running inside a container to affect the host system unintentionally.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants