Creating a Docker judge

[Bond-009]

As part of my internship at VIB I'm working a Dodona judge for Docker.
So far the most challenging part was building the Dockerfiles inside of the container where the judge is run. After trying multiple solutions (Docker in Docker, Podman in Docker and buildah) I've settled on kaniko. The advantage of using kaniko is that it doesn't require any modifications to how Dodona runs containers, unlike the other solutions it doesn't need a more privileged container. The kaniko executable itself should be executed as root, for testing purposes I've added sudo to the container and replaced the executable with a script that calls the original using sudo. This way it's transparent to the judge itself.
I would appreciate any input on how to improve this.

The code can be found here: https://github.com/Bond-009/judge-docker/tree/stable

[jorg-vr]

I already answered your email, but I'll copy the response here for future interested contributors:

For the docker judge, you''ll need to supply us with a docker file for the container in which your judge will be run. You can add a new docker file by creating a pr here: https://github.com/dodona-edu/docker-images
We'll also need to add your new judge to Dodona. This process is very similar to adding an exercise repository described here: https://docs.dodona.be/en/guides/exercises/new-exercise-repo/#_2-add-the-repository-to-dodona but only we have access to this interface.
So to add the judge in Dodona, you'll have to do the following steps:

• Make 'dodona-server' a collaborator in your github repo
• Provide us with the ssh clone link (already ok)
• Set the webhook provided by us in github

From that moment on, your judge will be available in Dodona and we'll automatically pull the latest version of your default branch every time you update the judge.

Anyway, I am pleased you've found a solution to the running docker within docker issue.
You've mentioned that sudo rights are required, but also that no changes to Dodona are needed, so am I correct to assume those sudo rights are only required within the container and do no present any security risks to our server?

Thanks again for your contribution, and sorry for leaving your discussion unanswered for a week.

[Bond-009]

For the docker judge, you''ll need to supply us with a docker file for the container in which your judge will be run. You can add a new docker file by creating a pr here: dodona-edu/docker-images

Created dodona-edu/docker-images#332

We'll also need to add your new judge to Dodona. This process is very similar to adding an exercise repository described here: docs.dodona.be/en/guides/exercises/new-exercise-repo#_2-add-the-repository-to-dodona but only we have access to this interface.
So to add the judge in Dodona, you'll have to do the following steps:

Make 'dodona-server' a collaborator in your github repo
Provide us with the ssh clone link (already ok)
Set the webhook provided by us in github

Since I'm doing this as part of an internship I don't think it makes much sense to have the judge be kept associated with my personal GitHub account. Would the Dodona team be willing to take over stewardship of this judge?

Anyway, I am pleased you've found a solution to the running docker within docker issue.
You've mentioned that sudo rights are required, but also that no changes to Dodona are needed, so am I correct to assume those sudo rights are only required within the container and do no present any security risks to our server?

The sudo rights are only required inside of the container, I don't think this presents significant security risks to your server, but I'm not a security expert. As far as I know this is the least privileged way to build an image inside of a container.

[jorg-vr]

Created dodona-edu/docker-images#332

Thanks, approved and merged

Would the Dodona team be willing to take over stewardship of this judge?

We'll take over stewardship in our organisation. I'll do this later today and add the judge to Dodona. I'll let you know once it is available

As far as I know this is the least privileged way to build an image inside of a container.

As the rights are only granted within the container it seems fine indeed.

[Bond-009]

Wow, this went way faster than I was expecting.

I was actually planning on refining the judge a bit more before actually including it. The stable branch which you've set as the default misuses the escalate-status command to report the error message generated by kaniko. This is an issue as the human description has a limit of 255 characters, so if the error is longer Dodona fails with a DB error.

The master branch is a bit more refined, there I just wanted to change de default behavior, to not fail the solution for every notice the linter generates.

[jorg-vr]

Ok, I'll set master as the default again. I used stable as you specifically linked that branch here.

I made you maintainer of the Repo as well. This way you can keep updating it once it has been added to Dodona

[jorg-vr]

Your judge has now been added to Dodona.

You can now create your own exercises to test it out. See https://docs.dodona.be/en/guides/exercises/new-exercise-repo/ for more info on how to add exercises to dodona.

You can also keep working on your judge in https://github.com/dodona-edu/judge-docker Every change to the master branch will automatically be deployed to Dodona

Thanks again for your contribution. Once your judge is ready and tested, you might also consider adding documentation and examples for other users. We can then add the judge to our overview here; https://docs.dodona.be/en/references/judges/ (This is not mandatory if the judge is only meant for internal use)