gristlabs_grist-core/app/gen-server/lib
Paul Fitzpatrick 134ae99e9a (core) add gvisor-based sandboxing to core
Summary:
This adds support for gvisor sandboxing in core. When Grist is run outside of a container, regular gvisor can be used (if on linux), and will run in rootless mode. When Grist is run inside a container, docker's default policy is insufficient for running gvisor, so a fork of gvisor is used that has less defence-in-depth but can run without privileges.

Sandboxing is automatically turned on in the Grist core container. It is not turned on automatically when built from source, since it is operating-system dependent.

This diff may break a complex method of testing Grist with gvisor on macs that I may have been the only person using. If anyone complains I'll find time on a mac to fix it :)

This diff includes a small "easter egg" to force document loads, primarily intended for developer use.

Test Plan: existing tests pass; checked that core and saas docker builds function

Reviewers: alexmojaki

Reviewed By: alexmojaki

Subscribers: alexmojaki

Differential Revision: https://phab.getgrist.com/D3333
2022-03-24 17:04:49 -04:00
..
DocApiForwarder.ts (core) Add PUT /records DocApi endpoint to AddOrUpdate records 2022-02-12 09:44:34 +02:00
DocWorkerMap.ts (core) Enforce daily limit on API usage 2022-03-22 00:22:45 +02:00
Doom.ts (core) add a tool for deleting a user 2021-09-29 12:08:23 -04:00
HomeDBManager.ts (core) add gvisor-based sandboxing to core 2022-03-24 17:04:49 -04:00
Housekeeper.ts (core) Exposing more descriptive errors from exports 2021-11-30 17:26:32 +01:00
Permissions.ts (core) move home server into core 2020-07-21 20:39:10 -04:00
scrubUserFromOrg.ts (core) move home server into core 2020-07-21 20:39:10 -04:00
TypeORMPatches.ts (core) revamp snapshot inventory 2020-10-30 13:52:46 -04:00
Usage.ts (core) discount indirect changes for access control purposes 2021-05-12 11:26:21 -04:00
values.ts (core) move home server into core 2020-07-21 20:39:10 -04:00