run_code as a user instead of root #94

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Draft

mishushakov wants to merge 17 commits into main

from permissions-calling-run_code-as-a-different-user-e2b-2123

Draft

run_code as a user instead of root #94

mishushakov wants to merge 17 commits into main from permissions-calling-run_code-as-a-different-user-e2b-2123

Conversation

@mishushakov

Copy link

Member

@mishushakov mishushakov commented Apr 28, 2025 •

edited

Loading

Jupyter Server and Code Interpreter are started as a non-privileged user
Adds ability to change user by creating a new context
BREAKING: Default user root > user to match the Sandbox commands.run behavior
POSSIBLY BREAKING: when cwd is not set and user is root, it will set cwd to /root

Sample code

const ctx = await sbx.createCodeContext({ language: "python", user: "user" })
const code = await sbx.runCode(`import getpass; print(getpass.getuser())`, { context })
console.log(code.logs);

{
 stdout: [ "user\n" ],
 stderr: [],
}

mishushakov added 3 commits

April 26, 2025 11:36

@mishushakov

wip

8ad22ef

@mishushakov


 fix file paths

14e0c51

@mishushakov


 fixes start command, adds logging, removes useradd in prod Docker

9d73789

@linear

Copy link

linear bot commented Apr 28, 2025

E2B-2123 Permissions: calling `run_code` as a different user

@mishushakov


 undo some changes to e2b.toml, bring back r kernel

e6edde7

@mishushakov mishushakov self-assigned this

Apr 28, 2025

@mishushakov mishushakov added the improvement label

Apr 28, 2025

@mishushakov mishushakov marked this pull request as ready for review

April 28, 2025 12:09

@mishushakov mishushakov requested review from 0div, ValentaTomas and jakubno as code owners

April 28, 2025 12:09

@jakubno Linear

Copy link

Member

jakubno commented Apr 28, 2025 •

edited

Loading

This won't be probably backwards compatible right?

Can I specify if I want run something as root?

@mishushakov

This comment was marked as outdated.

jakubno

jakubno requested changes

Apr 28, 2025

View reviewed changes

Copy link

Member

@jakubno jakubno left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we just need to be able to pass user. Otherwise, someone might need to run something as root, leading to the same issue.

mishushakov added 5 commits

April 29, 2025 15:52

@mishushakov

wip

4aeaeef

@mishushakov

wip

741e0e5

@mishushakov

qip

822beda

@mishushakov


 sync'd some changes from test.Dockerfile to Dockerfile

162c3de

@mishushakov


 changed deno kernel path

f1c427d

@mishushakov mishushakov marked this pull request as draft

April 30, 2025 16:12

@mishushakov


 change user in new context

38ee9c7

@mishushakov mishushakov requested a review from jakubno

May 2, 2025 09:25

@mishushakov


 Merge branch 'main' into permissions-calling-run_code-as-a-different-...

f16e512

...user-e2b-2123

@mishushakov mishushakov added feature and removed improvement labels

May 14, 2025

mishushakov added 2 commits

May 14, 2025 16:01

@mishushakov


 start default kernel as root to avoid breaking change

23f58ea

@mishushakov


 adds ability to pass user to the createCodeContext SDK method

4a8c98a

@mishushakov mishushakov marked this pull request as ready for review

May 14, 2025 14:14

@mishushakov


 added changeset

44c2a42

jakubno

jakubno requested changes

May 14, 2025

View reviewed changes

js/src/sandbox.ts Outdated Show resolved Hide resolved

template/e2b.toml Outdated Show resolved Hide resolved

template/server/api/models/create_context.py Outdated Show resolved Hide resolved

template/server/main.py Outdated Show resolved Hide resolved

template/test.Dockerfile

Comment on lines +79 to +83

# Change ownership of all files to user

RUN chown -R user:user $HOME

USER user

Copy link

Member

@jakubno jakubno May 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why are you doing it as last thing? If you would set the user as a first thing you probably don't need change the ownership

Copy link

Member Author

@mishushakov mishushakov May 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the problem here is: "user" does not exist in python image
and we cannot add user before we have "sudo" dependency installed

so this is why it's the last

mishushakov added 3 commits

May 14, 2025 16:57

@mishushakov


 changed default user to "user" as per @jakubno

d49ea96

@mishushakov


 change default cwd depending on the user if cwd is not provided

f4fc072

@mishushakov


 changed template to code-interpreter-v1beta1

feb767e

@mishushakov

Copy link

Member Author

mishushakov commented May 14, 2025

I created a new template, code-interpreter-v1beta1

mishushakov

mishushakov commented

May 15, 2025

View reviewed changes

template/e2b.toml

dockerfile = "e2b.Dockerfile"

template_name = "code-interpreter-v1"

template_id = "nlhz8vlwyupq845jsdg9"

start_cmd = "sudo -u user /home/user/.jupyter/start-up.sh"

Copy link

Member Author

@mishushakov mishushakov May 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

one thing: this is a breaking change, should I put a script in /root/.jupyter/start-up.sh that just calls the actual start-up.sh with sudo -u user?

@jakubno jakubno marked this pull request as draft

July 15, 2025 09:50

graphite-app[bot]

graphite-app bot reviewed

Sep 25, 2025

View reviewed changes

template/Dockerfile

# Copy matplotlibrc

COPY matplotlibrc /root/.config/matplotlib/.matplotlibrc

COPY matplotlibrc $HOME/.config/matplotlib/matplotlibrc

Copy link

Contributor

@graphite-app graphite-app bot Sep 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There's a path inconsistency between the Dockerfile and startup script. In the Dockerfile, the matplotlibrc file is copied to $HOME/.config/matplotlib/matplotlibrc (without a dot prefix), but in start-up.sh it's referenced as $HOME/.config/matplotlib/.matplotlibrc (with a dot prefix).

To resolve this, either:

Update this line to include the dot prefix: COPY matplotlibrc $HOME/.config/matplotlib/.matplotlibrc, or
Update the path in start-up.sh to remove the dot prefix: MATPLOTLIBRC=$HOME/.config/matplotlib/matplotlibrc

This will ensure the file is correctly located where the startup script expects to find it.

Suggested change

COPY matplotlibrc $HOME/.config/matplotlib/matplotlibrc

COPY matplotlibrc $HOME/.config/matplotlib/.matplotlibrc

Spotted by Diamond

Fix in Graphite

Is this helpful? React 👍 or 👎 to let us know.

@ValentaTomas ValentaTomas unassigned mishushakov

Sep 25, 2025

@ValentaTomas ValentaTomas removed the request for review from 0div

October 7, 2025 05:31

Labels

feature

2 participants

@mishushakov @jakubno

run_code as a user instead of root #94

Are you sure you want to change the base?

run_code as a user instead of root #94

Uh oh!

Conversation

@mishushakov mishushakov commented Apr 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

linear bot commented Apr 28, 2025

Uh oh!

jakubno commented Apr 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

@jakubno jakubno left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

@jakubno jakubno May 14, 2025

Choose a reason for hiding this comment

Uh oh!

@mishushakov mishushakov May 14, 2025

Choose a reason for hiding this comment

Uh oh!

mishushakov commented May 14, 2025

Uh oh!

@mishushakov mishushakov May 15, 2025

Choose a reason for hiding this comment

Uh oh!

@graphite-app graphite-app bot Sep 25, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

@mishushakov mishushakov commented Apr 28, 2025 •

edited

Loading

jakubno commented Apr 28, 2025 •

edited

Loading