fix privileges

compose.yaml

@@ -26,6 +26,7 @@
 
   worker:
     image: liquidcode-tester-worker:latest
+    privileged: true
     container_name: liquidcode-tester-worker
     build:
       context: .
@@ -36,16 +37,9 @@
       - ASPNETCORE_ENVIRONMENT=Development
     networks:
       - liquidcode-network
-    # Security hardening for Worker
+    # Mount cgroup for Isolate sandbox
-    security_opt:
+    volumes:
-      - no-new-privileges:true
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
-      - apparmor=docker-default
-    cap_drop:
-      - ALL
-    cap_add:
-      - SYS_ADMIN  # Required for Isolate namespaces
-      - SETUID     # Required for Isolate to change user context
-      - SETGID     # Required for Isolate to change group context
     # Temporary filesystem for compilation and testing
     tmpfs:
       - /tmp:exec,size=4G

src/LiquidCode.Tester.Worker/Dockerfile

@@ -82,10 +82,8 @@ RUN apt-get update && \
     && rm -rf /var/lib/apt/lists/*
 
 # Create unprivileged user for running the worker service
-RUN useradd -m -u 1001 -s /bin/bash workeruser && \
+RUN mkdir -p /var/local/lib/isolate && \
-    mkdir -p /var/local/lib/isolate && \
+    chmod 755 /var/local/lib/isolate
-    chmod 755 /var/local/lib/isolate && \
-    chown -R workeruser:workeruser /var/local/lib/isolate
 
 # Configure isolate directories and control-group root
 RUN printf "box_root = /var/local/lib/isolate\nlock_root = /run/isolate/locks\ncg_root = /sys/fs/cgroup\nfirst_uid = 60000\nfirst_gid = 60000\nnum_boxes = 1000\n" > /usr/local/etc/isolate.conf && \
@@ -96,13 +94,11 @@ RUN printf "box_root = /var/local/lib/isolate\nlock_root = /run/isolate/locks\nc
 COPY --from=publish /app/publish .
 
 # Create temp directory for compilation and testing with proper permissions
-RUN mkdir -p /tmp/testing && \
+RUN mkdir -p /tmp/testing
-    chown -R workeruser:workeruser /tmp/testing && \
-    chown -R workeruser:workeruser /app
 
 ENV ASPNETCORE_URLS=http://+:8080
 
 # Switch to unprivileged user
-USER workeruser
+#USER workeruser
 
 ENTRYPOINT ["dotnet", "LiquidCode.Tester.Worker.dll"]