docker-compose.sandbox.yml

Rama main · réplica de lectura del repositorio original.

# Optional local sandbox privileges for nsjail and SquashFS registry mounts.
# Usage:
#   TRACECAT__EXECUTOR_BACKEND=nsjail docker compose \
#     -f docker-compose.dev.yml -f docker-compose.sandbox.yml up
#   just cluster --sandbox up -d

services:
  executor:
    user: "0:0"
    cgroup: private
    entrypoint: ["python", "-m", "tracecat.sandbox.bootstrap"]
    environment:
      TRACECAT__EXECUTOR_BACKEND: ${TRACECAT__EXECUTOR_BACKEND:-nsjail}
    # Container-level fork-bomb bound: in-jail RLIMIT_NPROC is bypassable
    # via nested user namespaces (fresh per-userns fork counter).
    # All activities, loop iterations, and executor overhead share this cap.
    # Defaults allow 32 activities x 4 for_each iterations x 64 in-jail
    # processes = 8192, exceeding this intentional aggregate safety limit.
    # Process-heavy workloads can hit the cap and fail to fork.
    pids_limit: 4096
    # Required for nsjail sandbox execution.
    cap_add:
      - SYS_ADMIN
    security_opt:
      - seccomp:unconfined
      - systempaths=unconfined
    devices:
      - /dev/net/tun:/dev/net/tun
    # SquashFS registry artifact mounts additionally need loop-device access;
    # Docker's device cgroup blocks /dev/loop* with SYS_ADMIN alone.
    privileged: true

  agent-executor:
    user: "0:0"
    cgroup: private
    entrypoint: ["python", "-m", "tracecat.agent.sandbox.cgroup"]
    environment:
      TRACECAT__EXECUTOR_BACKEND: ${TRACECAT__EXECUTOR_BACKEND:-nsjail}
    # Same fork-bomb bound as executor (nested userns bypasses in-jail caps).
    pids_limit: 4096
    # Required for nsjail sandbox execution.
    cap_add:
      - SYS_ADMIN
    security_opt:
      - seccomp:unconfined
      - systempaths=unconfined
    devices:
      - /dev/net/tun:/dev/net/tun