data-advisor/compose.sandbox.yml at main · notts1215/data-advisor · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
# Add with -f compose.sandbox.yml to enable isolated CSV/XLSX analysis.
x-application-security: &application-security
  restart: unless-stopped
  read_only: true
  user: "10001:10001"
  cap_drop:
    - ALL
  security_opt:
    - no-new-privileges:true
  pids_limit: 128
  tmpfs:
    - /tmp:size=64m,mode=1777


x-python-service: &python-service
  <<: *application-security
  image: data-advisor-python:local
  build:
    context: .
    dockerfile: infra/docker/backend.Dockerfile

services:
  sandbox-runtime-image:
    <<: *application-security
    restart: "no"
    image: data-advisor-sandbox:local
    build:
      context: .
      dockerfile: infra/docker/sandbox.Dockerfile
    user: "10002:10002"
    command: ["python", "-c", "import duckdb, matplotlib, openpyxl, pandas"]
    network_mode: none

  sandbox-provisioner:
    <<: *python-service
    command:
      - uvicorn
      - sandbox_provisioner.main:app
      - --host
      - 0.0.0.0
      - --port
      - "8002"
    environment:
      SANDBOX_IMAGE: ${SANDBOX_IMAGE:-data-advisor-sandbox:local}
      SANDBOX_INTERNAL_TOKEN: ${SANDBOX_INTERNAL_TOKEN:?Set SANDBOX_INTERNAL_TOKEN in .env}
      DOCKER_BASE_URL: unix:///var/run/docker.sock
      SANDBOX_MAX_CONCURRENCY: ${SANDBOX_MAX_CONCURRENCY:-4}
      SANDBOX_MAX_CONCURRENCY_PER_ACTOR: ${SANDBOX_MAX_CONCURRENCY_PER_ACTOR:-2}
      SANDBOX_MAX_AGE_SECONDS: ${SANDBOX_MAX_AGE_SECONDS:-3600}
      SANDBOX_IDLE_TIMEOUT_SECONDS: ${SANDBOX_IDLE_TIMEOUT_SECONDS:-600}
      SANDBOX_REAPER_INTERVAL_SECONDS: ${SANDBOX_REAPER_INTERVAL_SECONDS:-60}
      SANDBOX_MAX_ATTEMPTS: ${SANDBOX_MAX_ATTEMPTS:-3}
      SANDBOX_RETRY_BASE_SECONDS: ${SANDBOX_RETRY_BASE_SECONDS:-1}
      SANDBOX_RETRY_MAX_SECONDS: ${SANDBOX_RETRY_MAX_SECONDS:-30}
      SANDBOX_CREATE_TIMEOUT_SECONDS: ${SANDBOX_CREATE_TIMEOUT_SECONDS:-300}
      SANDBOX_EXECUTION_TIMEOUT_SECONDS: ${SANDBOX_EXECUTION_TIMEOUT_SECONDS:-120}
      SANDBOX_MEMORY_MEGABYTES: ${SANDBOX_MEMORY_MEGABYTES:-512}
      SANDBOX_CPU_COUNT: ${SANDBOX_CPU_COUNT:-1}
      SANDBOX_PIDS_LIMIT: ${SANDBOX_PIDS_LIMIT:-64}
      SANDBOX_INPUT_MAX_BYTES: ${SANDBOX_INPUT_MAX_BYTES:-209715200}
      SANDBOX_OUTPUT_MAX_BYTES: ${SANDBOX_OUTPUT_MAX_BYTES:-26214400}
      SANDBOX_OUTPUT_MAX_FILES: ${SANDBOX_OUTPUT_MAX_FILES:-20}
    group_add:
      - "${DOCKER_GID:-0}"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    depends_on:
      sandbox-runtime-image:
        condition: service_completed_successfully
    networks:
      - internal
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8002/health', timeout=2)"]
      interval: 5s
      timeout: 3s
      retries: 10
      start_period: 5s

  background-control:
    environment:
      SANDBOX_ENABLED: "true"
      SANDBOX_PROVISIONER_URL: http://sandbox-provisioner:8002
      SANDBOX_INTERNAL_TOKEN: ${SANDBOX_INTERNAL_TOKEN:?Set SANDBOX_INTERNAL_TOKEN in .env}
    depends_on:
      sandbox-provisioner:
        condition: service_healthy

  run-worker:
    environment:
      SANDBOX_ENABLED: "true"
      SANDBOX_PROVISIONER_URL: http://sandbox-provisioner:8002
      SANDBOX_INTERNAL_TOKEN: ${SANDBOX_INTERNAL_TOKEN:?Set SANDBOX_INTERNAL_TOKEN in .env}
      SANDBOX_EXECUTION_POLICY: ${SANDBOX_EXECUTION_POLICY:-THREAD_SESSION}
      SANDBOX_SESSION_IDLE_SECONDS: ${SANDBOX_SESSION_IDLE_SECONDS:-600}
      SANDBOX_SESSION_ABSOLUTE_SECONDS: ${SANDBOX_SESSION_ABSOLUTE_SECONDS:-3600}
    depends_on:
      sandbox-provisioner:
        condition: service_healthy

  api:
    environment:
      SANDBOX_ENABLED: "true"