Extended CE: Sandboxed Compiles

Overleaf Extended CE comes with the option to run compiles in a secured sandbox environment for enterprise security. It does this by running every project in its own secured docker environment.

Toolkit

To enable sandboxed compiles (also known as "Sibling containers"), set the following configuration options in overleaf-toolkit/config/overleaf.rc:

SERVER_PRO=true
SIBLING_CONTAINERS_ENABLED=true

For additional details refer to Toolkit: Sandboxed Compiles.

docker-compose

In the following example, note the following:

• the docker socket volume mounted into the Overleaf container
• DOCKER_RUNNER set to true
• SANDBOXED_COMPILES set to true
• SANDBOXED_COMPILES_HOST_DIR set to /data/overleaf_data/data/compiles, the place on the host where the compile data will be written

services:
    sharelatex:
        ...
        volumes:
            - /data/overleaf_data:/var/lib/overleaf
            - /var/run/docker.sock:/var/run/docker.sock
        environment:
            ...
            DOCKER_RUNNER: "true"
            SANDBOXED_COMPILES: "true"
            SANDBOXED_COMPILES_HOST_DIR: "/data/overleaf_data/data/compiles"
            ...
        ...

Changing the TexLive Image

The following environment variables are used to specify which TeX Live images to use for sandboxed compiles:

• ALL_TEX_LIVE_DOCKER_IMAGES (required)
  • A comma-separated list of TeX Live images to use. These images will be downloaded or updated. To skip downloading, set SIBLING_CONTAINERS_PULL=false in config/overleaf.rc.
• ALL_TEX_LIVE_DOCKER_IMAGE_NAMES
  • A comma-separated list of friendly names for the images. If omitted, the version name will be used (e.g., latest-full).
• TEX_LIVE_DOCKER_IMAGE
  • The default TeX Live image used for compiling new projects. This image must be included in ALL_TEX_LIVE_DOCKER_IMAGES. If not set, the first image in ALL_TEX_LIVE_DOCKER_IMAGES will be used as the default image.

Users can select the image for their project in the project menu.

Here is an example where the default TeX Live image is latest-full from Docker Hub, but the TL2024-historic image can be used for older projects:

ALL_TEX_LIVE_DOCKER_IMAGES=texlive/texlive:latest-full, texlive/texlive:TL2024-historic
ALL_TEX_LIVE_DOCKER_IMAGE_NAMES=TeXLive 2025, TeXLive 2024
TEX_LIVE_DOCKER_IMAGE=texlive/texlive:latest-full

For additional details refer to Server Pro: Sandboxed Compiles.

When the compilation takes place in a dedicated container, it is relatively safe to permit running external commands from inside the TeX file during compilation. This is required for packages like minted. For this purpose, the following environment variable can be used:

• TEX_COMPILER_EXTRA_FLAGS
  • A list of extra flags for TeX compiler. Example: -shell-escape -file-line-error

Sample variables.env file for Overleaf Toolkit

OVERLEAF_APP_NAME="Our Overleaf Instance"

ENABLED_LINKED_FILE_TYPES=project_file,project_output_file,url

# Enables Thumbnail generation using ImageMagick
ENABLE_CONVERSIONS=true

# Disables email confirmation requirement
EMAIL_CONFIRMATION_DISABLED=true

## Nginx
# NGINX_WORKER_PROCESSES=4
# NGINX_WORKER_CONNECTIONS=768

## Set for TLS via nginx-proxy
# OVERLEAF_BEHIND_PROXY=true
# OVERLEAF_SECURE_COOKIE=true

OVERLEAF_SITE_URL=http://my-overleaf-instance.com
OVERLEAF_NAV_TITLE=Our Overleaf Instance
# OVERLEAF_HEADER_IMAGE_URL=http://somewhere.com/mylogo.png
OVERLEAF_ADMIN_EMAIL=support@example.com

OVERLEAF_LEFT_FOOTER=[{"text": "Contact your support team", "url": "mailto:support@example.com"}]
OVERLEAF_RIGHT_FOOTER=[{"text":"Hello, I am on the Right", "url":"https://github.com/yu-i-i/overleaf-cep"}]

OVERLEAF_EMAIL_FROM_ADDRESS=team@example.com
OVERLEAF_EMAIL_SMTP_HOST=smtp.example.com
OVERLEAF_EMAIL_SMTP_PORT=587
OVERLEAF_EMAIL_SMTP_SECURE=false
# OVERLEAF_EMAIL_SMTP_USER=
# OVERLEAF_EMAIL_SMTP_PASS=
# OVERLEAF_EMAIL_SMTP_NAME=
OVERLEAF_EMAIL_SMTP_LOGGER=false
OVERLEAF_EMAIL_SMTP_TLS_REJECT_UNAUTH=true
OVERLEAF_EMAIL_SMTP_IGNORE_TLS=false
OVERLEAF_CUSTOM_EMAIL_FOOTER=This system is run by department x

OVERLEAF_PROXY_LEARN=true
NAV_HIDE_POWERED_BY=true

########################
## Sandboxed Compiles ##
########################

ALL_TEX_LIVE_DOCKER_IMAGES=texlive/texlive:latest-full, texlive/texlive:TL2024-historic
ALL_TEX_LIVE_DOCKER_IMAGE_NAMES=TeXLive 2025, TeXLive 2024
TEX_LIVE_DOCKER_IMAGE=texlive/texlive:TL2024-historic
TEX_COMPILER_EXTRA_FLAGS=-shell-escape