running nsjail inside railway.
I wish to sandbox a script based on a javascript runtime. It works fine on docker but on railway gives a set of permission issues. Any hints?
25 Replies
Project ID:
98e76ea6-19e8-422c-813b-d262b3a47e33are you building with a dockerfile?
yes
because I need a few binaries.
and are you able to build the dockerfile locally and run the image and have your app work fine?
yes
then it's simply a case of railway does not start the image with significant privileges
ya, how do I fix this?
--privileged?
you can't modify the way railway runs the built image
I see
any alternative path comes to your mind? Should I Just reach to railway suppport?
the hobby plan only has community support available
I am on pro
fair enough
I can't see railway changing this anyway, the images are not started privileged for a good reason
ya
a vps is more fitting of this usecase in my opinion
railway is great for a lot of things, but it will never be a perfect fit for every usecase under the sun
I am going to create a small repo and try to run
bun or deno as a minimal server. just to be sure.
just to be sure that its not me.https://github.com/hiteshjoshi/nsjail_railway if you want to take a look
GitHub
hiteshjoshi/nsjail_railway
Contribute to hiteshjoshi/nsjail_railway development by creating an account on GitHub.
Out of context Qs: but is there any official place for railway bouty? I want to seek help from outside like that
what do you mean seek help from outside? outside of what? what kind of help?
I mean, I want to start bounty on helps like setup railway with any sandboxing library that basically restricts mounts. And propose is to the community, and see if any superman can pick it up and help me.
if railway isn't starting the images with significant privileges then I don't see how this can be achieved on railway
ya but someone can just not use nsjail and something else to help achieve it? I think somehow its nsjail specific error
I mean its not error. Its quite right. But there me something which just does micro of what nsjail is , and help me solve.
VPS is just too much efforts.
I agree vps are a lot of effort, but sometimes the usecase justifies it
have reached out to railway support though. Lets see
Figma
Server-side sandboxing: Virtual machines | Figma Blog
A deep dive on VMs and how we use them at Figma to achieve security isolation