glotcode / docker-run

Api for running untrusted code in containers
MIT License
105 stars 25 forks source link

code-runner: resource temporarily unavailable #6

Open matejrisek opened 2 years ago

matejrisek commented 2 years ago

Hi, I'm trying to run the project locally with docker. The examples from the API work fine until I try to run the example code - the run hangs waiting on the response from the python container.

From what I see the container dies immediately with:

exec /nix/store/mv32i0sb8sjpxlzj0p0dmx5sphy2arbw-rust_code-runner-1.2.0/bin/code-runner: resource temporarily unavailable

edit: Directly running the container from the image works:

> docker run -it glot/python:latest
{"language": "python", "files": [{"name": "main.py", "content": "print(42)"}]}
{"stdout":"42\n","stderr":"","error":""}

I'm using the latest image glot/python:latest.

Do you know what could be the root cause for it?

edit: It seems nproc limit is causing this issue. If I completely remove it from the container creation everything works fine. But if it is present, even with seemingly ridiculous values like:

            "Ulimits": [
                {
                    "Name": "nofile",
                    "Hard": 100,
                    "Soft": 90
                },
                {
                    "Name": "nproc",
                    "Hard": 100000,
                    "Soft": 200
                }
            ],

It starts erroring.

Many thanks, Matej

matejrisek commented 2 years ago

I've opened a PR to address this issue https://github.com/glotcode/glot-images/pull/4.

TLDR: When the user is created in any of the glot images it is created with UID 1000. UID 1000 is also a default local user ID. To enforce ulimits like nproc we then read the numbers for the local user, and that's why it fails if nproc is set to a relatively low value like it is by default (100).

Thanks to kind people of Reddit for figuring it out -> Reddit link