openEuler Intelligence Sandbox部署教程从Docker到Kubernetes的完整方案【免费下载链接】openeuler-intelligence-sandboxCode execution service for openEuler Intelligence supported multiple programming languages项目地址: https://gitcode.com/openeuler/openeuler-intelligence-sandbox前往项目官网免费下载https://ar.openeuler.org/ar/openEuler Intelligence Sandbox是一个基于FastAPI的多语言代码执行沙箱服务为openEuler Intelligence平台提供安全可靠的代码执行环境。本文将为您提供从基础Docker部署到高级Kubernetes集群部署的完整解决方案帮助您快速搭建和管理这个强大的代码沙箱服务。 项目概述与核心功能openEuler Intelligence Sandbox是一个专为openEuler Intelligence平台设计的代码执行沙箱服务支持Python、JavaScript和Bash三种编程语言的代码安全执行。该服务采用两级安全隔离架构为不同信任级别的代码提供相应的执行环境确保系统安全稳定运行。核心特性亮点 ✨多语言支持原生支持Python、JavaScript、Bash代码执行安全隔离两级安全等级低安全级别使用SecureExec执行器高安全级别使用Kubernetes容器执行器智能队列管理基于优先级的安全等级分队列管理资源控制可配置的CPU、内存和时间限制实时监控完整的API接口用于任务状态和系统监控 Docker容器化部署方案环境准备与依赖安装首先克隆项目仓库并安装必要的依赖# 克隆项目 git clone https://gitcode.com/openeuler/openeuler-intelligence-sandbox # 进入项目目录 cd openeuler-intelligence-sandbox # 安装Python依赖 pip install -r requirements.txt基础Docker部署项目提供了完整的Dockerfile支持快速构建容器镜像# 构建Docker镜像 docker build -t openeuler-sandbox:latest . # 运行容器 docker run -d -p 8000:8000 --name sandbox openeuler-sandbox:latestDocker Compose多服务部署对于生产环境建议使用Docker Compose进行多服务部署。创建docker-compose.yml文件version: 3.8 services: sandbox: build: . image: openeuler-sandbox:latest container_name: openeuler-sandbox ports: - 8000:8000 environment: - PYTHONUNBUFFERED1 - LOG_LEVELINFO restart: unless-stopped volumes: - ./logs:/app/logs - ./config:/app/config networks: - sandbox-network networks: sandbox-network: driver: bridge启动服务docker-compose up -d Kubernetes集群部署方案Kubernetes配置准备openEuler Intelligence Sandbox支持与Kubernetes集群集成为高安全级别的代码执行提供完全隔离的容器环境。在app/service.py中配置Kubernetes连接信息# 配置Kubernetes连接 k8s_config { namespace: code-sandbox, api_server: https://kubernetes.default.svc, token: /var/run/secrets/kubernetes.io/serviceaccount/token, ca_cert: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt }创建Kubernetes命名空间首先为代码沙箱服务创建专用的命名空间apiVersion: v1 kind: Namespace metadata: name: code-sandbox labels: app: openeuler-sandbox environment: production部署配置映射ConfigMap创建配置文件映射存储应用配置apiVersion: v1 kind: ConfigMap metadata: name: sandbox-config namespace: code-sandbox data: app_config.yaml: | security: low: max_concurrent_tasks: 10 default_timeout: 30 resource_limits: memory: 512Mi cpu: 1 high: max_concurrent_tasks: 3 default_timeout: 60 resource_limits: memory: 1Gi cpu: 2 logging: level: INFO format: %(asctime)s - %(name)s - %(levelname)s - %(message)s部署服务账户和角色绑定创建具有适当权限的服务账户apiVersion: v1 kind: ServiceAccount metadata: name: sandbox-sa namespace: code-sandbox --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: sandbox-role namespace: code-sandbox rules: - apiGroups: [] resources: [pods, pods/log, configmaps] verbs: [get, list, create, delete] --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: sandbox-rolebinding namespace: code-sandbox roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: sandbox-role subjects: - kind: ServiceAccount name: sandbox-sa namespace: code-sandbox部署主服务创建主服务的Deployment配置apiVersion: apps/v1 kind: Deployment metadata: name: openeuler-sandbox namespace: code-sandbox spec: replicas: 3 selector: matchLabels: app: openeuler-sandbox template: metadata: labels: app: openeuler-sandbox spec: serviceAccountName: sandbox-sa containers: - name: sandbox image: openeuler-sandbox:latest imagePullPolicy: IfNotPresent ports: - containerPort: 8000 env: - name: PYTHONUNBUFFERED value: 1 - name: LOG_LEVEL value: INFO resources: requests: memory: 256Mi cpu: 250m limits: memory: 512Mi cpu: 500m volumeMounts: - name: config-volume mountPath: /app/config - name: logs-volume mountPath: /app/logs volumes: - name: config-volume configMap: name: sandbox-config - name: logs-volume emptyDir: {}创建服务Service和入口Ingress暴露服务到集群外部apiVersion: v1 kind: Service metadata: name: sandbox-service namespace: code-sandbox spec: selector: app: openeuler-sandbox ports: - port: 8000 targetPort: 8000 type: ClusterIP --- apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: sandbox-ingress namespace: code-sandbox annotations: nginx.ingress.kubernetes.io/rewrite-target: / spec: rules: - host: sandbox.yourdomain.com http: paths: - path: / pathType: Prefix backend: service: name: sandbox-service port: number: 8000 配置与优化指南安全等级配置在app/executor_manager.py中可以调整不同安全等级的配置参数self.default_configs { SecurityLevel.LOW: ExecutorConfig( max_concurrent_tasks10, default_timeout30, resource_limits{memory: 512Mi, cpu: 1} ), SecurityLevel.HIGH: ExecutorConfig( max_concurrent_tasks3, default_timeout60, resource_limits{memory: 1Gi, cpu: 2} ) }执行器类型配置系统支持两种执行器类型可在app/executor_manager.py中配置SecureExecExecutor本地安全执行器适用于低安全级别ContainerExecutorKubernetes容器执行器适用于高安全级别资源限制配置在app/entities.py中可以调整资源限制参数timeout_seconds任务执行超时时间memory_limit_mb内存限制MBcpu_limitCPU限制核心数 监控与运维健康检查接口openEuler Intelligence Sandbox提供了完整的监控API# 健康检查 curl http://localhost:8000/health # 队列信息 curl http://localhost:8000/queues/info # 执行器状态 curl http://localhost:8000/executors/status # 系统整体状态 curl http://localhost:8000/system/status日志管理服务使用Python标准logging模块日志级别默认为INFO。可以通过修改app/service.py中的日志配置来调整logging.basicConfig( levellogging.DEBUG, # 调整日志级别 format%(asctime)s - %(name)s - %(levelname)s - %(message)s )Prometheus监控集成为生产环境添加Prometheus监控# prometheus.yml配置 scrape_configs: - job_name: openeuler-sandbox static_configs: - targets: [openeuler-sandbox:8000] metrics_path: /metrics scrape_interval: 15s 安全加固建议1. 网络隔离配置# 网络策略配置 apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: sandbox-network-policy namespace: code-sandbox spec: podSelector: matchLabels: app: openeuler-sandbox policyTypes: - Ingress - Egress ingress: - from: - namespaceSelector: matchLabels: name: ingress-namespace egress: - to: - ipBlock: cidr: 10.0.0.0/82. 资源配额限制# 资源配额配置 apiVersion: v1 kind: ResourceQuota metadata: name: sandbox-quota namespace: code-sandbox spec: hard: requests.cpu: 4 requests.memory: 8Gi limits.cpu: 8 limits.memory: 16Gi pods: 203. 安全上下文配置在Pod配置中添加安全上下文securityContext: runAsNonRoot: true runAsUser: 1000 runAsGroup: 1000 fsGroup: 1000 seccompProfile: type: RuntimeDefault 故障排除与常见问题任务执行失败排查检查执行器状态curl http://localhost:8000/executors/status查看队列信息curl http://localhost:8000/queues/info检查Kubernetes连接验证服务账户权限检查API服务器连接确认命名空间存在性能优化建议调整并发配置根据服务器资源调整max_concurrent_tasks优化队列优先级设置资源监控监控CPU和内存使用情况设置合理的资源限制日志轮转配置日志轮转策略避免日志文件过大高可用部署架构对于生产环境建议采用以下高可用架构┌─────────────────────────────────────────┐ │ Load Balancer │ │ (nginx/haproxy) │ └───────────────┬─────────────────────────┘ │ ┌───────────┼───────────┐ │ │ │ ┌───▼───┐ ┌───▼───┐ ┌───▼───┐ │ Node 1│ │ Node 2│ │ Node 3│ │ │ │ │ │ │ │ Pod A │ │ Pod B │ │ Pod C │ │ Pod D │ │ Pod E │ │ Pod F │ └───────┘ └───────┘ └───────┘ │ │ │ └───────────┼───────────┘ │ ┌───────▼───────┐ │ Shared │ │ Storage │ │ (NFS/Ceph) │ └───────────────┘ 扩展与自定义添加新的代码类型支持在app/entities.py中的CodeType枚举添加新类型在相应执行器中添加支持配置更新容器镜像映射创建自定义执行器继承BaseExecutor类并实现抽象方法class CustomExecutor(BaseExecutor): async def prepare_environment(self, request): # 实现环境准备逻辑 pass async def apply_security_constraints(self, request, env_info): # 实现安全约束逻辑 pass async def execute_code(self, request, env_info, security_config): # 实现代码执行逻辑 pass async def cleanup_environment(self, env_info): # 实现环境清理逻辑 pass 总结openEuler Intelligence Sandbox提供了一个强大而灵活的多语言代码执行沙箱解决方案。通过本文的部署教程您可以从简单的Docker部署开始逐步扩展到完整的Kubernetes集群部署构建出安全、可靠、可扩展的代码执行环境。无论您是开发测试环境还是生产部署openEuler Intelligence Sandbox都能提供合适的部署方案。记得根据实际需求调整资源配置和安全策略确保系统既安全又高效运行。核心部署要点回顾Docker部署适合快速验证和开发环境Kubernetes部署提供生产级的高可用和安全隔离合理配置安全等级和资源限制实施监控和日志管理策略定期进行安全审计和性能优化通过遵循本文的部署指南您可以快速搭建和管理openEuler Intelligence Sandbox服务为您的应用提供安全可靠的代码执行能力【免费下载链接】openeuler-intelligence-sandboxCode execution service for openEuler Intelligence supported multiple programming languages项目地址: https://gitcode.com/openeuler/openeuler-intelligence-sandbox创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考
openEuler Intelligence Sandbox部署教程：从Docker到Kubernetes的完整方案
发布时间：2026/7/9 19:26:36
openEuler Intelligence Sandbox部署教程从Docker到Kubernetes的完整方案【免费下载链接】openeuler-intelligence-sandboxCode execution service for openEuler Intelligence supported multiple programming languages项目地址: https://gitcode.com/openeuler/openeuler-intelligence-sandbox前往项目官网免费下载https://ar.openeuler.org/ar/openEuler Intelligence Sandbox是一个基于FastAPI的多语言代码执行沙箱服务为openEuler Intelligence平台提供安全可靠的代码执行环境。本文将为您提供从基础Docker部署到高级Kubernetes集群部署的完整解决方案帮助您快速搭建和管理这个强大的代码沙箱服务。 项目概述与核心功能openEuler Intelligence Sandbox是一个专为openEuler Intelligence平台设计的代码执行沙箱服务支持Python、JavaScript和Bash三种编程语言的代码安全执行。该服务采用两级安全隔离架构为不同信任级别的代码提供相应的执行环境确保系统安全稳定运行。核心特性亮点 ✨多语言支持原生支持Python、JavaScript、Bash代码执行安全隔离两级安全等级低安全级别使用SecureExec执行器高安全级别使用Kubernetes容器执行器智能队列管理基于优先级的安全等级分队列管理资源控制可配置的CPU、内存和时间限制实时监控完整的API接口用于任务状态和系统监控 Docker容器化部署方案环境准备与依赖安装首先克隆项目仓库并安装必要的依赖# 克隆项目 git clone https://gitcode.com/openeuler/openeuler-intelligence-sandbox # 进入项目目录 cd openeuler-intelligence-sandbox # 安装Python依赖 pip install -r requirements.txt基础Docker部署项目提供了完整的Dockerfile支持快速构建容器镜像# 构建Docker镜像 docker build -t openeuler-sandbox:latest . # 运行容器 docker run -d -p 8000:8000 --name sandbox openeuler-sandbox:latestDocker Compose多服务部署对于生产环境建议使用Docker Compose进行多服务部署。创建docker-compose.yml文件version: 3.8 services: sandbox: build: . image: openeuler-sandbox:latest container_name: openeuler-sandbox ports: - 8000:8000 environment: - PYTHONUNBUFFERED1 - LOG_LEVELINFO restart: unless-stopped volumes: - ./logs:/app/logs - ./config:/app/config networks: - sandbox-network networks: sandbox-network: driver: bridge启动服务docker-compose up -d Kubernetes集群部署方案Kubernetes配置准备openEuler Intelligence Sandbox支持与Kubernetes集群集成为高安全级别的代码执行提供完全隔离的容器环境。在app/service.py中配置Kubernetes连接信息# 配置Kubernetes连接 k8s_config { namespace: code-sandbox, api_server: https://kubernetes.default.svc, token: /var/run/secrets/kubernetes.io/serviceaccount/token, ca_cert: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt }创建Kubernetes命名空间首先为代码沙箱服务创建专用的命名空间apiVersion: v1 kind: Namespace metadata: name: code-sandbox labels: app: openeuler-sandbox environment: production部署配置映射ConfigMap创建配置文件映射存储应用配置apiVersion: v1 kind: ConfigMap metadata: name: sandbox-config namespace: code-sandbox data: app_config.yaml: | security: low: max_concurrent_tasks: 10 default_timeout: 30 resource_limits: memory: 512Mi cpu: 1 high: max_concurrent_tasks: 3 default_timeout: 60 resource_limits: memory: 1Gi cpu: 2 logging: level: INFO format: %(asctime)s - %(name)s - %(levelname)s - %(message)s部署服务账户和角色绑定创建具有适当权限的服务账户apiVersion: v1 kind: ServiceAccount metadata: name: sandbox-sa namespace: code-sandbox --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: sandbox-role namespace: code-sandbox rules: - apiGroups: [] resources: [pods, pods/log, configmaps] verbs: [get, list, create, delete] --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: sandbox-rolebinding namespace: code-sandbox roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: sandbox-role subjects: - kind: ServiceAccount name: sandbox-sa namespace: code-sandbox部署主服务创建主服务的Deployment配置apiVersion: apps/v1 kind: Deployment metadata: name: openeuler-sandbox namespace: code-sandbox spec: replicas: 3 selector: matchLabels: app: openeuler-sandbox template: metadata: labels: app: openeuler-sandbox spec: serviceAccountName: sandbox-sa containers: - name: sandbox image: openeuler-sandbox:latest imagePullPolicy: IfNotPresent ports: - containerPort: 8000 env: - name: PYTHONUNBUFFERED value: 1 - name: LOG_LEVEL value: INFO resources: requests: memory: 256Mi cpu: 250m limits: memory: 512Mi cpu: 500m volumeMounts: - name: config-volume mountPath: /app/config - name: logs-volume mountPath: /app/logs volumes: - name: config-volume configMap: name: sandbox-config - name: logs-volume emptyDir: {}创建服务Service和入口Ingress暴露服务到集群外部apiVersion: v1 kind: Service metadata: name: sandbox-service namespace: code-sandbox spec: selector: app: openeuler-sandbox ports: - port: 8000 targetPort: 8000 type: ClusterIP --- apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: sandbox-ingress namespace: code-sandbox annotations: nginx.ingress.kubernetes.io/rewrite-target: / spec: rules: - host: sandbox.yourdomain.com http: paths: - path: / pathType: Prefix backend: service: name: sandbox-service port: number: 8000 配置与优化指南安全等级配置在app/executor_manager.py中可以调整不同安全等级的配置参数self.default_configs { SecurityLevel.LOW: ExecutorConfig( max_concurrent_tasks10, default_timeout30, resource_limits{memory: 512Mi, cpu: 1} ), SecurityLevel.HIGH: ExecutorConfig( max_concurrent_tasks3, default_timeout60, resource_limits{memory: 1Gi, cpu: 2} ) }执行器类型配置系统支持两种执行器类型可在app/executor_manager.py中配置SecureExecExecutor本地安全执行器适用于低安全级别ContainerExecutorKubernetes容器执行器适用于高安全级别资源限制配置在app/entities.py中可以调整资源限制参数timeout_seconds任务执行超时时间memory_limit_mb内存限制MBcpu_limitCPU限制核心数 监控与运维健康检查接口openEuler Intelligence Sandbox提供了完整的监控API# 健康检查 curl http://localhost:8000/health # 队列信息 curl http://localhost:8000/queues/info # 执行器状态 curl http://localhost:8000/executors/status # 系统整体状态 curl http://localhost:8000/system/status日志管理服务使用Python标准logging模块日志级别默认为INFO。可以通过修改app/service.py中的日志配置来调整logging.basicConfig( levellogging.DEBUG, # 调整日志级别 format%(asctime)s - %(name)s - %(levelname)s - %(message)s )Prometheus监控集成为生产环境添加Prometheus监控# prometheus.yml配置 scrape_configs: - job_name: openeuler-sandbox static_configs: - targets: [openeuler-sandbox:8000] metrics_path: /metrics scrape_interval: 15s 安全加固建议1. 网络隔离配置# 网络策略配置 apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: sandbox-network-policy namespace: code-sandbox spec: podSelector: matchLabels: app: openeuler-sandbox policyTypes: - Ingress - Egress ingress: - from: - namespaceSelector: matchLabels: name: ingress-namespace egress: - to: - ipBlock: cidr: 10.0.0.0/82. 资源配额限制# 资源配额配置 apiVersion: v1 kind: ResourceQuota metadata: name: sandbox-quota namespace: code-sandbox spec: hard: requests.cpu: 4 requests.memory: 8Gi limits.cpu: 8 limits.memory: 16Gi pods: 203. 安全上下文配置在Pod配置中添加安全上下文securityContext: runAsNonRoot: true runAsUser: 1000 runAsGroup: 1000 fsGroup: 1000 seccompProfile: type: RuntimeDefault 故障排除与常见问题任务执行失败排查检查执行器状态curl http://localhost:8000/executors/status查看队列信息curl http://localhost:8000/queues/info检查Kubernetes连接验证服务账户权限检查API服务器连接确认命名空间存在性能优化建议调整并发配置根据服务器资源调整max_concurrent_tasks优化队列优先级设置资源监控监控CPU和内存使用情况设置合理的资源限制日志轮转配置日志轮转策略避免日志文件过大高可用部署架构对于生产环境建议采用以下高可用架构┌─────────────────────────────────────────┐ │ Load Balancer │ │ (nginx/haproxy) │ └───────────────┬─────────────────────────┘ │ ┌───────────┼───────────┐ │ │ │ ┌───▼───┐ ┌───▼───┐ ┌───▼───┐ │ Node 1│ │ Node 2│ │ Node 3│ │ │ │ │ │ │ │ Pod A │ │ Pod B │ │ Pod C │ │ Pod D │ │ Pod E │ │ Pod F │ └───────┘ └───────┘ └───────┘ │ │ │ └───────────┼───────────┘ │ ┌───────▼───────┐ │ Shared │ │ Storage │ │ (NFS/Ceph) │ └───────────────┘ 扩展与自定义添加新的代码类型支持在app/entities.py中的CodeType枚举添加新类型在相应执行器中添加支持配置更新容器镜像映射创建自定义执行器继承BaseExecutor类并实现抽象方法class CustomExecutor(BaseExecutor): async def prepare_environment(self, request): # 实现环境准备逻辑 pass async def apply_security_constraints(self, request, env_info): # 实现安全约束逻辑 pass async def execute_code(self, request, env_info, security_config): # 实现代码执行逻辑 pass async def cleanup_environment(self, env_info): # 实现环境清理逻辑 pass 总结openEuler Intelligence Sandbox提供了一个强大而灵活的多语言代码执行沙箱解决方案。通过本文的部署教程您可以从简单的Docker部署开始逐步扩展到完整的Kubernetes集群部署构建出安全、可靠、可扩展的代码执行环境。无论您是开发测试环境还是生产部署openEuler Intelligence Sandbox都能提供合适的部署方案。记得根据实际需求调整资源配置和安全策略确保系统既安全又高效运行。核心部署要点回顾Docker部署适合快速验证和开发环境Kubernetes部署提供生产级的高可用和安全隔离合理配置安全等级和资源限制实施监控和日志管理策略定期进行安全审计和性能优化通过遵循本文的部署指南您可以快速搭建和管理openEuler Intelligence Sandbox服务为您的应用提供安全可靠的代码执行能力【免费下载链接】openeuler-intelligence-sandboxCode execution service for openEuler Intelligence supported multiple programming languages项目地址: https://gitcode.com/openeuler/openeuler-intelligence-sandbox创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考
