mirror of
https://github.com/gristlabs/grist-core.git
synced 2024-10-27 20:44:07 +00:00
134ae99e9a
Summary: This adds support for gvisor sandboxing in core. When Grist is run outside of a container, regular gvisor can be used (if on linux), and will run in rootless mode. When Grist is run inside a container, docker's default policy is insufficient for running gvisor, so a fork of gvisor is used that has less defence-in-depth but can run without privileges. Sandboxing is automatically turned on in the Grist core container. It is not turned on automatically when built from source, since it is operating-system dependent. This diff may break a complex method of testing Grist with gvisor on macs that I may have been the only person using. If anyone complains I'll find time on a mac to fix it :) This diff includes a small "easter egg" to force document loads, primarily intended for developer use. Test Plan: existing tests pass; checked that core and saas docker builds function Reviewers: alexmojaki Reviewed By: alexmojaki Subscribers: alexmojaki Differential Revision: https://phab.getgrist.com/D3333
38 lines
1.1 KiB
TypeScript
38 lines
1.1 KiB
TypeScript
import {ActiveDoc} from 'app/server/lib/ActiveDoc';
|
|
import {ICreate} from 'app/server/lib/ICreate';
|
|
import {createSandbox} from 'app/server/lib/NSandbox';
|
|
|
|
export const create: ICreate = {
|
|
Billing() {
|
|
return {
|
|
addEndpoints() { /* do nothing */ },
|
|
addEventHandlers() { /* do nothing */ },
|
|
addWebhooks() { /* do nothing */ }
|
|
};
|
|
},
|
|
Notifier() {
|
|
return {
|
|
get testPending() { return false; },
|
|
deleteUser() { throw new Error('deleteUser unavailable'); },
|
|
};
|
|
},
|
|
Shell() {
|
|
return {
|
|
moveItemToTrash() { throw new Error('moveToTrash unavailable'); },
|
|
showItemInFolder() { throw new Error('showItemInFolder unavailable'); }
|
|
};
|
|
},
|
|
ExternalStorage() { return undefined; },
|
|
ActiveDoc(docManager, docName, options) { return new ActiveDoc(docManager, docName, options); },
|
|
NSandbox(options) {
|
|
return createSandbox('unsandboxed', options);
|
|
},
|
|
sessionSecret() {
|
|
return process.env.GRIST_SESSION_SECRET ||
|
|
'Phoo2ag1jaiz6Moo2Iese2xoaphahbai3oNg7diemohlah0ohtae9iengafieS2Hae7quungoCi9iaPh';
|
|
},
|
|
configurationOptions() {
|
|
return {};
|
|
}
|
|
};
|