Skip to content

Draft: Handle venv in firejail

Marc Debureaux requested to merge debnet/hkis-website:venv_in_firejail into master

Problem: in order to preserve filesystem and for security purposes, answers are evaluated inside a sandbox which is unable to use python binary inside a virtualenv (by using the system's python binary if available), preventing the use of external dependencies unless by installing them as root (not nice).

First idea: copy site-package in tempdir and use it as PYTHONPATH in firejail. It's slow, may not work with every configuration (it's just a draft) and consumes disk space (but it's easy to temper this with a dedicated venv I guess?).

I tried to play with firejail configuration in order to settle custom directories but with no luck.

I created this PR in order to discuss the different ways to deal with this issue.

Merge request reports