execengine.ini

#############################################
#       ExecEngine Configuration File       #
#############################################
# You can change the ExecEngine             #
# configuration as you see fit! Currently,  #
# there are a number of parameters that     #
# define restrictions on working with       #
# isolation environment resources, as well  #
# as basic API settings.                    #
#                                           #
# This is the only user-facing application  #
# configuration file. Replace every SET_ or #
# GENERATE_ secret before first deployment. #
# Docker config-init issues least-privilege  #
# role copies from this source file.         #
#                                           #
# Description of all the parameters that you#
# can change is provided. Read description  #
# of the parameters that you want to change.#
#############################################

#############################################
#           PROJECT BASIC SETTINGS          #
#############################################
# This section presents the basic project   #
# settings that do not affect the API's     #
# operation. Changes to these settings will #
# only be reflected in the documentation    #
# automatically generated via Swagger.      #
#############################################
[PROJECT BASIC SETTINGS]
# PROJECT_NAME defines the name of the project in the documentation
PROJECT_NAME = ExecEngine API
# PROJECT_VERSION defines the version of the project in the documentation
PROJECT_VERSION = 1.2.0
# PROJECT_DESCRIPTION defines the description of the project in the documentation
PROJECT_DESCRIPTION = ExecEngine is designed to run untrusted code in web-centric environments and applications.
# ENABLE_AUTO_GENERATED_DOCS Replaces classic documentation with documentation automatically generated using Swagger and ReDoc.
# Set the value to True to open automatic documentation when you enter /docs.
ENABLE_AUTO_GENERATED_DOCS = True
# MAINTENANCE_MODE
MAINTENANCE_MODE = False

#############################################
#            CONNECTION SETTINGS            #
#############################################
# Database and RabbitMQ settings are kept in #
# separate sections so config-init can issue #
# least-privilege role configuration files.  #
#############################################
[DATABASE SETTINGS]
# DATABASE_HOST specifies the host for connecting to the database. Not recommended to change!
DATABASE_HOST = db
DATABASE_PORT = 5432
# DATABASE_NAME specifies the name of the database. Not recommended to change!
DATABASE_NAME = exec_engine
DATABASE_USER = execengine
# Replace before deployment. Use a unique value of at least 16 characters.
DATABASE_PASSWORD = SET_A_UNIQUE_DATABASE_PASSWORD

[RABBITMQ SETTINGS]
# RABBITMQ_HOST defines the host for connecting to the message broker. In Compose it must remain rabbitmq.
RABBITMQ_HOST = rabbitmq
RABBITMQ_PORT = 5672
RABBITMQ_USER = execengine
# Replace before deployment. It must differ from the database password.
RABBITMQ_PASSWORD = SET_A_UNIQUE_RABBITMQ_PASSWORD

#############################################
#      BOOTSTRAP ADMINISTRATOR SETTINGS     #
#############################################
# These values are issued only to the one-shot bootstrap container.
[BOOTSTRAP ADMIN SETTINGS]
ADMIN_USERNAME = execengine_owner
ADMIN_PASSWORD = SET_A_UNIQUE_ADMINISTRATOR_PASSWORD
ADMIN_EMAIL = owner@example.com
ADMIN_NAME = ExecEngine Owner

#############################################
#              WORKER SETTINGS              #
#############################################
# Worker identity is taken from this section or, when empty, from the
# process/container hostname. Start with one full-toolchain job per worker;
# horizontal capacity is added by starting more worker processes.
[WORKER SETTINGS]
# Leave empty for Docker Compose: every replica uses its container hostname.
WORKER_ID =
WORKER_POOL = full
WORKER_CONCURRENCY = 1
# Offset is only needed when multiple worker processes share the same host-level
# isolate state. Separate worker containers normally have independent state.
WORKER_BOX_ID_OFFSET = 0
# A worker is shown as offline by the API after this many seconds without a heartbeat.
WORKER_HEARTBEAT_INTERVAL = 10
WORKER_STALE_THRESHOLD = 45
# A processing lease is renewed while execution is alive. It must be longer than
# the renewal interval so a short DB hiccup does not create a duplicate attempt.
WORKER_LEASE_DURATION = 60
WORKER_LEASE_RENEWAL_INTERVAL = 10
# Prevent poison/redelivered messages from forming a tight broker loop.
WORKER_REDELIVERY_BACKOFF = 1

#############################################
#             CALLBACK SETTINGS             #
#############################################
[CALLBACK SETTINGS]
# Leave empty for Docker Compose: every replica uses its container hostname.
CALLBACK_WORKER_ID =
CALLBACK_POLL_INTERVAL = 2
CALLBACK_BATCH_SIZE = 20
CALLBACK_CONCURRENCY = 10
CALLBACK_HTTP_TIMEOUT = 5
CALLBACK_MAX_ATTEMPTS = 5
CALLBACK_LEASE_DURATION = 30
# Delays after attempts 1, 2, 3 and 4. The last value is reused when needed.
CALLBACK_RETRY_DELAYS = 30,120,600,1800

#############################################
#            MAINTENANCE SETTINGS           #
#############################################
[MAINTENANCE SETTINGS]
SUBMISSION_RETENTION_DAYS = 30
MAINTENANCE_DELETE_BATCH_SIZE = 1000
MAINTENANCE_MAX_BATCHES_PER_RUN = 100
MAINTENANCE_SUBMISSIONS_INTERVAL = 86400
MAINTENANCE_API_TOKENS_INTERVAL = 3600

#############################################
#            SECRET KEY SETTINGS            #
#############################################
# This section defines the settings for     #
# generating a secret key for issuing API   #
# tokens during user authentication on the  #
# server. We recommend using a complex      #
# secret key to minimize the risk of user   #
# data leakage.                             #
#############################################
[SECRET KEY SETTINGS]
# Replace with an independently generated random value of at least 32 characters.
SECRET_KEY = GENERATE_A_RANDOM_SECRET_KEY_OF_AT_LEAST_32_CHARACTERS
# ALGORITHM required to determine the method of creating a digital signature token.
# More about algorithms: https://jose.readthedocs.io/en/latest/
ALGORITHM = HS256
# ACCESS_TOKEN_EXPIRE_MINUTES specifies the time in minutes after which the JWT token will become inactive.
# Measurement unit: minutes
ACCESS_TOKEN_EXPIRE_MINUTES = 30

#############################################
#               LOGGING SETTINGS            #
#############################################
[LOGGING SETTINGS]
# Application lifecycle log level: DEBUG, INFO, WARNING, ERROR or CRITICAL.
LOG_LEVEL = INFO
# SQL statements and bound values are hidden at the default WARNING level.
# Temporarily set INFO only for local database diagnostics.
SQL_LOG_LEVEL = WARNING
# Empty writes application and SQL logs to stdout/stderr (recommended in Docker).
# A manual deployment may set an explicitly writable file path.
SQL_LOG_FILE =

#############################################
#BATCH SIZE AND CONCURENT SUBMISSIONS LIMITS#
#############################################
# This section contains parameters that     #
# determine the limits on parallel          #
# processing of user requests and on the    #
# size of batch requests. It is not         #
# recommended to set high values in order to#
# avoid excessive load on the server.       #
#############################################
[BATCH SIZE AND CONCURENT SUBMISSIONS LIMITS]
# MAX_CONCURENT_SUBMISSIONS determines the number of streams that can be occupied by user requests in a single time interval (requests are executed in parallel with each other).
# Measurement unit: number of concurent submissions
MAX_CONCURRENT_SUBMISSIONS = 5
# MAX_BATCH_SIZE determines the maximum size of a batch request that a user can send. Exceeding this value will result in a corresponding error from the server.
# Measurement unit: number of requests in batch.
MAX_BATCH_SIZE = 50

#############################################
#          DB CONNECTION SETTINGS           #
#############################################
# Additional database connection settings   #
# that determine the server's behavior in   #
# case of no access to the database.        #
#############################################
[DB CONNECTION SETTINGS]
# DB_MAX_RETRIES determines the number of attempts to reconnect to the database in case of errors on the server. If the API fails to connect after the specified number of attempts, the server stops working.
# Measurement unit: number of retries
DB_MAX_RETRIES = 100
# DB_MAX_TIMEOUT specifies the time interval in seconds after which the API will attempt to connect to the database again.
# Measurement unit: seconds
DB_MAX_TIMEOUT = 3

#############################################
#          DEFAULT RESOURCE LIMITS          #
#############################################
# This section contains parameters that set #
# standard restrictions on resource usage in#
# an isolated environment. These values will#
# be substituted automatically if the user  #
# doesn't specify other values in the       #
# request.                                  #
#############################################
[DEFAULT RESOURCE LIMITS]
# DEFAULT_TIME_LIMIT sets the default value for the “time_limit” parameter if the user does not specify it in the request.
# Measurement unit: seconds (can be fractional). 
DEFAULT_TIME_LIMIT = 2
# DEFAULT_MEMORY_LIMIT sets the default value for the “memory_limit” parameter if the user does not specify it in the request.
# Measurement unit: Kilobytes.
DEFAULT_MEMORY_LIMIT = 64000
# DEFAULT_EXTRA_TIME sets the default value for the “extra_time” parameter if the user does not specify it in the request.
# Measurement unit: seconds (can be fractional).
DEFAULT_EXTRA_TIME = 0.5
# DEFAULT_WALL_TIME_LIMIT sets the default value for the “wall_time_limit” parameter if the user does not specify it in the request.
# Measurement unit: seconds (can be fractional).
DEFAULT_WALL_TIME_LIMIT = 3
# DEFAULT_STACK_SIZE sets the default value for the “stack_size” parameter if the user does not specify it in the request.
# Measurement unit: Kilobytes.
DEFAULT_STACK_SIZE = 64000
# DEFAULT_MAX_FILE_SIZE sets the default value for the “max_file_size” parameter if the user does not specify it in the request.
# Measurement unit: Kilobytes.
DEFAULT_MAX_FILE_SIZE = 1024

#############################################
#            MAX RESOURCE LIMITS            #
#############################################
# The settings in this section define the   #
# maximum values for resource limits that   #
# can be used by the user when sending a    #
# request. If you try to specify a value    #
# that exceeds the one specified here, the  #
# server will return a corresponding error. #
#############################################
[MAX RESOURCE LIMITS]
# MAX_TIME_LIMIT defines the maximum permissible value for the “time_limit” parameter, which the user can specify in the request.
# Measurement unit: seconds (can be fractional).
MAX_TIME_LIMIT = 60
# MAX_MEMORY_LIMIT defines the maximum permissible value for the “memory_limit” parameter, which the user can specify in the request.
# Measurement unit: Kilobytes.
MAX_MEMORY_LIMIT = 512000
# MAX_EXTRA_TIME defines the maximum permissible value for the “extra_time” parameter, which the user can specify in the request.
# Measurement unit: seconds (can be fractional).
MAX_EXTRA_TIME = 10.0
# MAX_WALL_TIME_LIMIT defines the maximum permissible value for the “wall_time_limit” parameter, which the user can specify in the request.
# Measurement unit: seconds (can be fractional).
MAX_WALL_TIME_LIMIT = 61
# MAX_STACK_SIZE defines the maximum permissible value for the “stack_size” parameter, which the user can specify in the request.
# Measurement unit: Kilobytes.
MAX_STACK_SIZE = 128000
# MAX_FILE_SIZE defines the maximum permissible value for the “max_file_size” parameter, which the user can specify in the request.
# Measurement unit: Kilobytes.
MAX_FILE_SIZE = 65536

#############################################
#       EXECUTION SECURITY LIMITS           #
#############################################
[EXECUTION SECURITY LIMITS]
# Limits are bytes and protect the worker before isolate starts.
MAX_ADDITIONAL_ARCHIVE_BYTES = 16777216
MAX_ADDITIONAL_EXTRACTED_BYTES = 67108864
MAX_ADDITIONAL_FILES = 256
MAX_CAPTURED_OUTPUT_BYTES = 4194304
ISOLATE_CLEANUP_TIMEOUT = 10

#############################################
#              OTHER SETTINGS               #
#############################################
# The settings in this section cannot be    #
# defined in other sections, but they also  #
# determine how the API works in a number of#
# unique situations.                        #
#############################################
[OTHER SETTINGS]
# ALLOW_ENABLE_NETWORK determines the possibility of using the Internet within the user request (directly affects the operation of the “allow_network” parameter). 
# If a False value is set, Internet access will be restricted.
ALLOW_ENABLE_NETWORK = False
# ALWAYS_REDIRECT_STDERR_TO_STDOUT allows you to redirect the error stream to the standard output stream in all user requests (the API ignores the “redirect_stderr_to_stdout” parameter).
# If the value is set to True, the API will redirect stderr to stdout on a permanent basis.
ALWAYS_REDIRECT_STDERR_TO_STDOUT = False
# ALLOW_COMMAND_LINE_ARGS allows users to specify command line arguments during program code execution.
# If set to False, command line arguments will be completely disabled.
ALLOW_COMMAND_LINE_ARGS = False
# ALLOW_COMPILER_OPTIONS allows users to set additional compiler options during query execution.
# If a False value is set, the “compiler_options” parameter will be ignored by the API service.
ALLOW_COMPILER_OPTIONS = False
# ALLOW_WAIT
ALLOW_WAIT = True
# Maximum time the HTTP request waits for a worker result. Timing out never
# cancels or deletes the queued submission.
API_WAIT_TIMEOUT = 30
# PostgreSQL polling interval used by wait=true requests.
API_WAIT_POLL_INTERVAL = 0.2
# PROTECTED_SOFTWARE_CONFIGURATION allows you to hide the API service configuration from all users except administrators.
# If set to True, the result of the “/configuration/software” endpoint will be hidden from users who do not have extended privileges (administrators).
PROTECTED_SOFTWARE_CONFIGURATION = True
# PROTECTED_HARDWARE_CONFIGURATION allows you to hide the server configuration from all users except administrators.
# If set to True, the result of the endpoint “/configuration/software” will be hidden for users who do not have extended privileges (administrators).
PROTECTED_HARDWARE_CONFIGURATION = True