Add example for running Codapi in a Lima instance

[afbjorklund]

You can run codapi in a nerdctl container, with the "default" template:

limactl start default

• feat: allow overriding docker executable #37

The home directory is mounted into the VM by default, but read-only.

---

Or you can run codapi in a dedicated instance (VM), maybe with docker:

limactl start codapi

• doc: add lima yaml file for codapi #39

No mounts from the host system, only the (automatic) port forwarding.

[afbjorklund]

The lima.yaml has been added, question is if it needs more docs?

limactl start --cpus 2 --memory 2 https://raw.githubusercontent.com/nalgeon/codapi/refs/heads/main/docs/lima/codapi.yaml

Like comparing pros and cons between running in containers/VMs.

Or if it needs an expanded version, with running a web server too?

---

Container (with nerdctl)

• Running rootless containers, possibly in a shared VM
• Sharing cpu and memory with other applications

VM (as implemented here)

• Running rootful containers, in a separate debian VM
• Dedicated cpu and memory for the codapi instance

Both solutions have a "codapi" user, with a separate home directory.
And each sandbox runs as a "sandbox" user, in a separate namespace.

The difference is if there are other users on the same machine - or not.
The rootful docker has full access to it, but the home directory is "empty".

https://docs.docker.com/engine/security/#docker-daemon-attack-surface

---

The motivation for making a dedicated Lima instance was based on the:

Make sure you install Codapi on a separate machine — this is a must for security reasons. Do not store any sensitive data or credentials on this machine. This way, even if someone runs malicious code that somehow escapes the isolated environment, they won't have access to your other machines and data.

The default instance is sharing the home directory, just like a Linux host

https://lima-vm.io/docs/usage/#home-directory

[nalgeon]

question is if it needs more docs?

I don't know :) Sadly, I don't have the capacity to test or document this setup.

[afbjorklund]

I will try to find some volunteers, to see if the docs "work" or not

Maybe I should also have mentioned how to access codapi "admin"?

It is (rather) straight-forward, and not very different to other setups.

anders@ubuntu:~$ limactl shell codapi 
anders@lima-codapi:~$ pwd
/home/anders.guest
anders@lima-codapi:~$ sudo su - codapi
codapi@lima-codapi:~$ pwd
/opt/codapi

Will make a PR, also found an issue with the permission on sandboxes:

codapi@lima-codapi:~$ ./codapi-cli sandbox add lua
Downloading from https://github.com/nalgeon/sandboxes/releases/download/latest/lua.tar.gz...
##O#- #                                                                         Warning: Failed to open the file sandboxes/lua.tar.gz: Permission denied
curl: (23) client returned ERROR on write of 689 bytes

ERROR: Failed to download sandbox archive from https://github.com/nalgeon/sandboxes/releases/download/latest/lua.tar.gz

-rw-r--r-- 1 codapi codapi   11365 Apr 18 06:39 LICENSE
-rwxr-xr-x 1 codapi codapi 7381176 Apr 18 06:40 codapi
-rwxr-xr-x 1 codapi codapi    7381 Apr 18 06:39 codapi-cli
-rw-r--r-- 1 codapi codapi     422 Apr 18 06:39 codapi.json
-rw-r--r-- 1 root   root       314 Apr 19 09:31 codapi.log
drwxr-xr-x 3 root   root      4096 Apr 19 09:31 sandboxes

Pretty sure that it was in codapi.tar.gz, so missing something here...

anders@lima-codapi:~$ sudo chown codapi /opt/codapi/sandboxes

The default user has sudo on the debian box, so easy to work around.

[afbjorklund]

Eventually (with some debugging logging) I remembered:

+ sudo su - codapi
+ whoami
root
+ cd /opt/codapi
++ curl -fsSL https://api.github.com/repos/nalgeon/codapi/releases/latest
++ jq -r .tag_name
++ sed -e s/v//
+ version=0.14.0
+ case $(uname -m) in
++ uname -m
+ arch=amd64
+ curl -fL -o codapi.tar.gz https://github.com/nalgeon/codapi/releases/download/v0.14.0/codapi_0.14.0_linux_amd64.tar.gz
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
100 3049k  100 3049k    0     0  2131k      0  0:00:01  0:00:01 --:--:-- 3022k
+ tar xvzf codapi.tar.gz
LICENSE
codapi-cli
codapi.json
codapi.service
sandboxes/ash/Dockerfile
sandboxes/ash/box.json
sandboxes/ash/commands.json
codapi
+ ls -l
total 10296
-rw-r--r-- 1 codapi codapi   11365 Apr 18 06:39 LICENSE
-rwxr-xr-x 1 codapi codapi 7381176 Apr 18 06:40 codapi
-rwxr-xr-x 1 codapi codapi    7381 Apr 18 06:39 codapi-cli
-rw-r--r-- 1 codapi codapi     422 Apr 18 06:39 codapi.json
-rw-r--r-- 1 codapi codapi     304 Apr 18 06:39 codapi.service
-rw-r--r-- 1 root   root   3122415 Apr 19 13:01 codapi.tar.gz
drwxr-xr-x 3 root   root      4096 Apr 19 13:01 sandboxes
+ rm -f codapi.tar.gz

When you run su from a script, it does NOT start a new shell...

• fix: remove sudo from lima provision #42