run_code as a user instead of root #94

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Draft

mishushakov wants to merge 17 commits into main

from permissions-calling-run_code-as-a-different-user-e2b-2123

Draft

run_code as a user instead of root #94

mishushakov wants to merge 17 commits into main from permissions-calling-run_code-as-a-different-user-e2b-2123

Conversation

mishushakov

Copy link

Member

@mishushakov mishushakov commented Apr 28, 2025 •

edited

Loading

Jupyter Server and Code Interpreter are started as a non-privileged user
Adds ability to change user by creating a new context
BREAKING: Default user root > user to match the Sandbox commands.run behavior
POSSIBLY BREAKING: when cwd is not set and user is root, it will set cwd to /root

Sample code

const ctx = await sbx.createCodeContext({ language: "python", user: "user" })
const code = await sbx.runCode(`import getpass; print(getpass.getuser())`, { context })
console.log(code.logs);

{
 stdout: [ "user\n" ],
 stderr: [],
}

mishushakov added 3 commits

April 26, 2025 11:36

@mishushakov

wip

8ad22ef

@mishushakov


 fix file paths

14e0c51

@mishushakov


 fixes start command, adds logging, removes useradd in prod Docker

9d73789

@linear Linear

Copy link

linear bot commented Apr 28, 2025

E2B-2123 Permissions: calling `run_code` as a different user

@mishushakov


 undo some changes to e2b.toml, bring back r kernel

e6edde7

@mishushakov mishushakov self-assigned this

Apr 28, 2025

@mishushakov mishushakov added the improvement label

Apr 28, 2025

@mishushakov mishushakov marked this pull request as ready for review

April 28, 2025 12:09

@mishushakov mishushakov requested review from jakubno, ValentaTomas and 0div as code owners

April 28, 2025 12:09

@jakubno Linear

Copy link

Member

jakubno commented Apr 28, 2025 •

edited

Loading

This won't be probably backwards compatible right?

Can I specify if I want run something as root?

@mishushakov

This comment was marked as outdated.

jakubno

jakubno requested changes

Apr 28, 2025

View reviewed changes

Copy link

Member

@jakubno jakubno left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we just need to be able to pass user. Otherwise, someone might need to run something as root, leading to the same issue.

mishushakov added 5 commits

April 29, 2025 15:52

@mishushakov

wip

4aeaeef

@mishushakov

wip

741e0e5

@mishushakov

qip

822beda

@mishushakov


 sync'd some changes from test.Dockerfile to Dockerfile

162c3de

@mishushakov


 changed deno kernel path

f1c427d

@mishushakov mishushakov marked this pull request as draft

April 30, 2025 16:12

@mishushakov


 change user in new context

38ee9c7

@mishushakov mishushakov requested a review from jakubno

May 2, 2025 09:25

@mishushakov


 Merge branch 'main' into permissions-calling-run_code-as-a-different-...

f16e512

...user-e2b-2123

@mishushakov mishushakov added feature and removed improvement labels

May 14, 2025

mishushakov added 2 commits

May 14, 2025 16:01

@mishushakov


 start default kernel as root to avoid breaking change

23f58ea

@mishushakov


 adds ability to pass user to the createCodeContext SDK method

4a8c98a

@mishushakov mishushakov marked this pull request as ready for review

May 14, 2025 14:14

@mishushakov


 added changeset

44c2a42

jakubno

jakubno requested changes

May 14, 2025

View reviewed changes

js/src/sandbox.ts Outdated Show resolved Hide resolved

template/e2b.toml Outdated Show resolved Hide resolved

template/server/api/models/create_context.py Outdated Show resolved Hide resolved

template/server/main.py Outdated Show resolved Hide resolved

template/test.Dockerfile

Comment on lines +79 to +83

# Change ownership of all files to user

RUN chown -R user:user $HOME

USER user

Copy link

Member

@jakubno jakubno May 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why are you doing it as last thing? If you would set the user as a first thing you probably don't need change the ownership

Copy link

Member Author

@mishushakov mishushakov May 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the problem here is: "user" does not exist in python image
and we cannot add user before we have "sudo" dependency installed

so this is why it's the last

mishushakov added 3 commits

May 14, 2025 16:57

@mishushakov


 changed default user to "user" as per @jakubno

d49ea96

@mishushakov


 change default cwd depending on the user if cwd is not provided

f4fc072

@mishushakov


 changed template to code-interpreter-v1beta1

feb767e

@mishushakov

Copy link

Member Author

mishushakov commented May 14, 2025

I created a new template, code-interpreter-v1beta1

mishushakov

mishushakov commented

May 15, 2025

View reviewed changes

template/e2b.toml

dockerfile = "e2b.Dockerfile"

template_name = "code-interpreter-v1"

template_id = "nlhz8vlwyupq845jsdg9"

start_cmd = "sudo -u user /home/user/.jupyter/start-up.sh"

Copy link

Member Author

@mishushakov mishushakov May 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

one thing: this is a breaking change, should I put a script in /root/.jupyter/start-up.sh that just calls the actual start-up.sh with sudo -u user?

@jakubno jakubno marked this pull request as draft

July 15, 2025 09:50

Labels

feature

2 participants

@mishushakov @jakubno

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

run_code as a user instead of root #94

Are you sure you want to change the base?

run_code as a user instead of root #94

Uh oh!

Conversation

@mishushakov mishushakov commented Apr 28, 2025 •

edited

Loading

Uh oh!

Uh oh!

linear bot commented Apr 28, 2025

Uh oh!

jakubno commented Apr 28, 2025 •

edited

Loading

Uh oh!

Uh oh!

This comment was marked as outdated.

@jakubno jakubno left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

@jakubno jakubno May 14, 2025

Choose a reason for hiding this comment

Uh oh!

@mishushakov mishushakov May 14, 2025

Choose a reason for hiding this comment

Uh oh!

mishushakov commented May 14, 2025

Uh oh!

@mishushakov mishushakov May 15, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

run_code as a user instead of root #94

Are you sure you want to change the base?

run_code as a user instead of root #94

Uh oh!

Conversation

@mishushakov mishushakov commented Apr 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

linear bot commented Apr 28, 2025

Uh oh!

jakubno commented Apr 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

@jakubno jakubno left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

@jakubno jakubno May 14, 2025

Choose a reason for hiding this comment

Uh oh!

@mishushakov mishushakov May 14, 2025

Choose a reason for hiding this comment

Uh oh!

mishushakov commented May 14, 2025

Uh oh!

@mishushakov mishushakov May 15, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

@mishushakov mishushakov commented Apr 28, 2025 •

edited

Loading

jakubno commented Apr 28, 2025 •

edited

Loading