dockerized worker

Author: adwinwhite

ui/src/worker.rs

@@ -624,11 +624,44 @@ impl From<(JobReport, serde_json::Value, ResponseKind)> for WSResponse {
     }
 }
 
+macro_rules! docker_command {
+    ($($arg:expr),* $(,)?) => ({
+        let mut cmd = Command::new("docker");
+        $( cmd.arg($arg); )*
+        cmd
+    });
+}
+
+fn basic_secure_docker_command() -> Command {
+    docker_command!(
+        "run",
+        "--platform",
+        "linux/amd64",
+        "--cap-drop=ALL",
+        // Needed to allow overwriting the file
+        "--security-opt=no-new-privileges",
+        "--net",
+        "none",
+        "--memory",
+        "512m",
+        "--memory-swap",
+        "640m",
+        "--pids-limit",
+        "512",
+    )
+}
+
+
 fn run_worker_in_background() -> Result<(ChildStdin, ChildStdout)> {
-    const WORKER_FILEPATH: &str = "../worker-message/target/debug/worker";
+    // For local development.
+    // const WORKER_FILEPATH: &str = "../worker-message/target/debug/worker";
+
     // No need to track Child.
     // We know whether it exits via channels.
-    let mut child = Command::new(WORKER_FILEPATH)
+    // let mut child = Command::new(WORKER_FILEPATH)
+    let mut child = basic_secure_docker_command()
+        .arg("-i")
+        .arg("adwinw/rust-playground-worker")
         .stdin(Stdio::piped())
         .stdout(Stdio::piped())
         .spawn()

worker-message/Dockerfile

@@ -0,0 +1,11 @@
+# 1. This tells docker to use the Rust official image
+FROM rust:1.68
+
+# 2. Copy the files in your machine to the Docker image
+COPY ./ ./
+
+# Build your program for release
+RUN cargo build --release
+
+# Run the binary
+CMD ["./target/release/worker"]

worker-message/src/worker.rs

@@ -73,7 +73,7 @@ pub async fn listen() {
 
         let project_path = project_dir.path();
         loop {
-            let coordinator_msg = coordinator_rx.recv().await.expect("Failed to received CoordinatorMessage from deserialization task");
+            let coordinator_msg = coordinator_rx.recv().await.expect("Failed to receive CoordinatorMessage from deserialization task");
             info!("{:#?}", coordinator_msg);
             match coordinator_msg {
                 CoordinatorMessage::Request(job_id, job) => {