65 lines
2.9 KiB
Docker
65 lines
2.9 KiB
Docker
# =====================================================================
|
|
# owuitools-octave - the code execution sandbox.
|
|
#
|
|
# This is the only container in the suite that runs code supplied by
|
|
# whoever is talking to the model. It therefore gets the strictest
|
|
# treatment in docker-compose.yml: network_mode "none", read-only root,
|
|
# non-root user, all capabilities dropped.
|
|
#
|
|
# It has NO network stack at all, so it cannot be given work over HTTP.
|
|
# Jobs arrive as files on a small tmpfs volume shared with the API
|
|
# container, and results go back the same way. See run.sh.
|
|
# =====================================================================
|
|
FROM debian:12-slim
|
|
|
|
# octave-* forge packages cover the four toolboxes people actually reach
|
|
# for in general engineering work. They are NOT auto-loaded: run.sh does
|
|
# the `pkg load` calls, because a script that says `pkg load signal`
|
|
# itself is valid Octave but is not valid MATLAB, and we do not want the
|
|
# model learning to write it.
|
|
RUN apt-get update \
|
|
&& DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
|
|
octave \
|
|
octave-signal \
|
|
octave-control \
|
|
octave-statistics \
|
|
octave-optim \
|
|
gnuplot-nox \
|
|
ghostscript \
|
|
fonts-freefont-otf \
|
|
fonts-dejavu-core \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Path shim, deliberately outside any working directory so it cannot show
|
|
# up as a user artefact or be shadowed by a user file. See shim/print.m.
|
|
# Octave never tells gnuplot to fill the legend background, so plot lines
|
|
# show through it. See the script for why this is a build-time edit.
|
|
COPY patch-legend-opaque.sh /tmp/patch-legend-opaque.sh
|
|
RUN sh /tmp/patch-legend-opaque.sh && rm /tmp/patch-legend-opaque.sh
|
|
|
|
COPY shim/ /opt/owuitools-shim/
|
|
# The shims implement MATLAB functions this Octave does not have, on a
|
|
# path that sits ahead of everything. Two things have to be true at build
|
|
# time and cannot be checked later: that Octave has not since acquired the
|
|
# function itself (in which case ours is deleted rather than allowed to
|
|
# shadow it), and that each one does what MATLAB documents. The script
|
|
# fails the build if a shim is wrong.
|
|
COPY check-shims.sh /tmp/check-shims.sh
|
|
RUN sh /tmp/check-shims.sh && rm /tmp/check-shims.sh
|
|
|
|
COPY run.sh /usr/local/bin/run.sh
|
|
RUN chmod 0555 /usr/local/bin/run.sh
|
|
|
|
# Unprivileged, and with a home it can actually write to (a read-only
|
|
# root filesystem means HOME must live on the tmpfs).
|
|
# Same uid as owuitools-api on purpose. The two containers share one small
|
|
# tmpfs for job files, and matching uids let that volume be mode 0700 -
|
|
# unreadable to anything else - instead of world-writable. It grants no
|
|
# privilege: they are separate containers with separate namespaces, and
|
|
# the uid only decides who can touch /jobs.
|
|
RUN useradd --uid 10001 --create-home --home-dir /home/runner --shell /usr/sbin/nologin runner
|
|
USER 10001:10001
|
|
ENV HOME=/tmp/octhome
|
|
|
|
ENTRYPOINT ["/usr/local/bin/run.sh"]
|