search

autolab / Tango

Standalone RESTful autograding service
http://www.autolabproject.com/
Apache License 2.0
48 stars 60 forks source link

Implement docker outgoing firewall #254

Open evanyeyeye opened 5 months ago

evanyeyeye commented 5 months ago

Description

Motivation and Context

How Has This Been Tested?

coderabbitai[bot] commented 5 months ago
Walkthrough ## Walkthrough The update enhances the system by introducing the capability to specify allowed outgoing IP addresses for jobs, likely aimed at bolstering security and managing network traffic. This new feature spans multiple components, impacting job object creation, Docker-based job execution, and worker job handling. It involves incorporating a parameter to track permitted IPs and setting up network rules to restrict outgoing traffic to these designated addresses during job execution. ## Changes | Files | Change Summary | |------------------------|----------------| | `tangoREST/tangoREST.py`, `tangoObjects.py` | Updated `convertJobObj` method in `tangoREST.py` to handle `allowed_outgoing_ips` in `jobObj` dictionary, introducing `allowedOutgoingIPs` to `TangoJob` object in `tangoObjects.py`. | | `vmms/localDocker.py` | Added `allowedOutgoingIPs` parameter to `runJob` method in `localDocker.py`. Configures `iptables` rules to allow outgoing traffic to specified IPs before running jobs in Docker containers if networking is enabled. | | `worker.py` | Integrated `allowedOutgoingIPs` into job execution logic in `worker.py` to enforce restrictions on network traffic. |
Recent Review Details **Configuration used: CodeRabbit UI**
Commits Files that changed from the base of the PR and between 553bd1dae3e5776043a093e86802a0dd84231fca and 70bb3a06c6359d986e260b0cdd24a1890e9849c1.
Files selected for processing (1) * vmms/localDocker.py (3 hunks)
Additional comments not posted (1)
vmms/localDocker.py (1)
`180-196`: > :memo: **NOTE** > This review was outside the diff hunks and was mapped to the diff hunk with the greatest overlap. Original lines [145-193] Ensure that the `allowedOutgoingIPs` parameter is properly validated before use. While the code correctly handles the `allowedOutgoingIPs` when `disableNetwork` is `False`, it's crucial to ensure that the IPs provided are in a valid format to prevent potential security risks or misconfigurations. Consider adding a validation step to check the format of the IPs before they are used in the `iptables` command.
--- Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media?
Share - [X](https://twitter.com/intent/tweet?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A&url=https%3A//coderabbit.ai) - [Mastodon](https://mastodon.social/share?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A%20https%3A%2F%2Fcoderabbit.ai) - [Reddit](https://www.reddit.com/submit?title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&text=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code.%20Check%20it%20out%3A%20https%3A//coderabbit.ai) - [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fcoderabbit.ai&mini=true&title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&summary=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code)
Tips ### Chat There are 3 ways to chat with [CodeRabbit](https://coderabbit.ai): - Review comments: Directly reply to a review comment made by CodeRabbit. Example: - `I pushed a fix in commit .` - `Generate unit testing code for this file.` - `Open a follow-up GitHub issue for this discussion.` - Files and specific lines of code (under the "Files changed" tab): Tag `@coderabbitai` in a new review comment at the desired location with your query. Examples: - `@coderabbitai generate unit testing code for this file.` - `@coderabbitai modularize this function.` - PR comments: Tag `@coderabbitai` in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples: - `@coderabbitai generate interesting stats about this repository and render them as a table.` - `@coderabbitai show all the console.log statements in this repository.` - `@coderabbitai read src/utils.ts and generate unit testing code.` - `@coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.` Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. ### CodeRabbit Commands (invoked as PR comments) - `@coderabbitai pause` to pause the reviews on a PR. - `@coderabbitai resume` to resume the paused reviews. - `@coderabbitai review` to trigger a review. This is useful when automatic reviews are disabled for the repository. - `@coderabbitai resolve` resolve all the CodeRabbit review comments. - `@coderabbitai help` to get help. Additionally, you can add `@coderabbitai ignore` anywhere in the PR description to prevent this PR from being reviewed. ### CodeRabbit Configration File (`.coderabbit.yaml`) - You can programmatically configure CodeRabbit by adding a `.coderabbit.yaml` file to the root of your repository. - Please see the [configuration documentation](https://docs.coderabbit.ai/guides/configure-coderabbit) for more information. - If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: `# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json` ### Documentation and Community - Visit our [Documentation](https://coderabbit.ai/docs) for detailed information on how to use CodeRabbit. - Join our [Discord Community](https://discord.com/invite/GsXnASn26c) to get help, request features, and share feedback. - Follow us on [X/Twitter](https://twitter.com/coderabbitai) for updates and announcements.