nsjail.cfg

name: "anvil-nsjail"
description: "nsjail configuration for anvil & uvicorn server."

mode: ONCE
uidmap {inside_id: "1000"}
gidmap {inside_id: "1000"}
disable_rl: true
time_limit: 2147483647

clone_newnet: false # share net namespace

envar: "PYTHONPATH=/opt/python/lib"
envar: "INSTANCE_DIR=/tmp/instances"
envar: "UNIX_SOCKET_LOCATION=/home/user/anvil_server.sock"

cwd: "/home/user"

mount: [
  {
    src: "/chroot"
    dst: "/"
    is_bind: true
    rw: true # foundry insists on spewing cache files everywhere
  },
  {
    src: "/usr/bin/kctf_restore_env"
    dst: "/bin/kctf_restore_env"
    is_bind: true
    is_dir: false
  },
  {
    src: "/paradigm/environ"
    dst: "/environ"
    is_bind: true
    is_dir: false
    mandatory: false
  },
  {
    src: "/tmp"
    dst: "/tmp"
    rw: true
    is_bind: true
  },
  {
    dst: "/proc"
    fstype: "proc"
    rw: true
  },
  {
    src: "/etc/resolv.conf"
    dst: "/etc/resolv.conf"
    is_bind: true
  },
  {
    src: "/dev"
    dst: "/dev"
    is_bind: true
  },
  {
    src: "/dev/null",
    dst: "/dev/null",
    is_bind: true,
  }
]