frenata / xaqt

Evaluate arbitrary user code in a docker based sandbox.
MIT License
7 stars 5 forks source link

Support running the service in a docker container #5

Open frenata opened 6 years ago

frenata commented 6 years ago

From #2 :

dockerize compilebox API server: right now, the compilebox API server doesn't run in docker, but it should be really easy to get that up and running. In my opinion this would dramatically increase the ease of use since,

  1. it would simplify the setup (just docker build and run the container; no build dependencies like gb etc.)
  2. it would simplify integration with other backend services using docker-compose But, you may ask-- "wait, doesn't compilebox spin up a docker container tho? Wouldn't that mean....a docker container....in a.... docker container????". While docker in docker is a thing (not recommended), luckily we can allow docker containers to spin up sibling containers by making compilebox use the docker daemon of the host. See this blog post for more details. I've actually already started working on this in a fork so I'll probably be submitting a PR at some point.
asmr-hex commented 6 years ago

Overview

The idea is that, when running a compilebox API server, we only need to run build.sh which will handle building the actual compilebox Docker image and the API server image. Systems which will interact with the API server should be able to integrate both Dockerfiles into their deployment setup (e.g. docker-compose.yml).

Proposed Changes

Usage

normally we can just run docker run on our API server image, but since the running container will be using Docker, we want to make it use the Docker daemon on the host. We can do this by running,

λ docker run -v /var/run/docker.sock:/var/run/docker.sock -d --name server_container server_image

which links the docker daemon socket in the container with the one on the host. This allows the host to spin up a sibling container.

Note that we can also specify this runtime argument within docker-compose.yml.

Questions

frenata commented 6 years ago

Possibly relevant to your work: since the actual sandbox is unlikely to change much, I've pushed it to docker hub https://hub.docker.com/r/frenata/xaqt/ (also experimenting with the proposed name).

We'll presumably still want the Dockerfile in the repo somewhere so that we can change it, but it could be moved out of the base directory. And presumably when you compose the images, you can pull it directly.

frenata commented 6 years ago

I changed it so that https://hub.docker.com/r/frenata/xaqt-sandbox/ is set as the sandbox itself, so that we can use frenata/xaqt as the service target.

Once this is issue is resolved I'll make the appropriate changes to auto-build that target too.

frenata commented 6 years ago

FYI @connorwalsh , I had to do some major surgery on the Dockerfile since it suddenly stopped building. Security certs for the version of node being built got deprecated apparently.

asmr-hex commented 6 years ago

@frenata, no worries! sorry for radio silence-- i'm getting back on this probably tomorrow

asmr-hex commented 6 years ago

@frenata, no worries! sorry for radio silence-- i'm getting back on this probably tomorrow

frenata commented 6 years ago

It's cool @connorwalsh , I haven't exactly been spending a lot of time on this lately either. Hoping to get back to a bit soon though.

asmr-hex commented 6 years ago

@frenata i was working on this previously but i am going to switch gears and refactor the library to use the Go Docker API since i think that is more valuable.