CompilerExplorer-Deploy/compose.kata.yaml at main · Compiler-Security/CompilerExplorer-Deploy · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
name: ce

# Kata 备选路径；默认 QEMU 路径见 compose.yaml。

services:
  ce:
    build:
      context: .
      dockerfile: kata/Dockerfile
      args:
        CE_REF: "${CE_REF:-gh-18904}"
    image: ssct/compiler-explorer:local
    container_name: ce-app
    restart: unless-stopped
    runtime: kata

    user: "10001:10001"

    cap_drop: ["ALL"]
    security_opt:
      - no-new-privileges:true
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,nodev,size=2g,uid=10001,gid=10001,mode=1777
      - /ce/out/compiler-cache:rw,noexec,nosuid,nodev,size=1g,uid=10001,gid=10001,mode=0700
    pids_limit: 2048

    volumes:
      # SELinux Enforcing 时给此挂载追加 z。
      - "${CE_COMPILERS_ROOT:?请在 .env 设置 CE_COMPILERS_ROOT（cp .env.example .env 后改实际路径）}:/opt/compiler-explorer:ro"
      - "${CE_KATA_STORAGE_ROOT:-kata-storage}:/ce/lib/storage/data"
      - ./config/c.local.properties:/ce/etc/config/c.local.properties:ro
      - ./config/c++.local.properties:/ce/etc/config/c++.local.properties:ro
      - ./config/lean.local.properties:/ce/etc/config/lean.local.properties:ro
      - ./config/llvm.local.properties:/ce/etc/config/llvm.local.properties:ro
      - ./config/llvm_mir.local.properties:/ce/etc/config/llvm_mir.local.properties:ro
      - ./config/mlir.local.properties:/ce/etc/config/mlir.local.properties:ro
      - ./config/compiler-explorer.local.properties:/ce/etc/config/compiler-explorer.local.properties:ro
      # Kata 已提供 VM 边界，不启用容器内 nsjail。

    ports:
      - "10240:10240"

    mem_limit: 6g
    cpus: 8

volumes:
  kata-storage:
    name: "${CE_KATA_STORAGE_VOLUME_NAME:-ce-shortlinks-kata}"