From 9774a199c89cc8f2cb1d75631019ffb7e9dd77f9 Mon Sep 17 00:00:00 2001 From: Taylor Agarwal Date: Tue, 8 Sep 2026 12:59:18 -0400 Subject: [PATCH] =?UTF-8?q?=F0=9F=90=9B=20Fix=20security=20context=20for?= =?UTF-8?q?=20job-queue-service?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- deploy/job-queue-service.yml | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/deploy/job-queue-service.yml b/deploy/job-queue-service.yml index f277d51..728abbb 100644 --- a/deploy/job-queue-service.yml +++ b/deploy/job-queue-service.yml @@ -38,21 +38,20 @@ spec: spec: terminationGracePeriodSeconds: 60 serviceAccountName: harbor-orchestrator - securityContext: - fsGroup: 1001 containers: - image: ghcr.io/redhat-et/coding_agent_bench:v0.2.1 name: job-queue command: ["/bin/sh", "-c"] args: - | - mkdir -p ~/.ssh && \ - ([ -f /app/data/nebius-ssh-key ] || ssh-keygen -t ed25519 -f /app/data/nebius-ssh-key -N "" -q) && \ - chmod 600 /app/data/nebius-ssh-key && \ + if [ ! -f /app/data/nebius-ssh-key ]; then + ssh-keygen -t ed25519 -f /app/data/nebius-ssh-key -N "" -q || exit 1 + fi + test -r /app/data/nebius-ssh-key || exit 1 exec env \ NEBIUS_SSH_PUBLIC_KEY_PATH=/app/data/nebius-ssh-key.pub \ NEBIUS_SSH_PRIVATE_KEY_PATH=/app/data/nebius-ssh-key \ - uv run uvicorn coding_agent_bench.api:app --host 0.0.0.0 --port 8443 \ + uv run --no-sync uvicorn coding_agent_bench.api:app --host 0.0.0.0 --port 8443 \ --ssl-certfile /etc/job-queue/tls/tls.crt \ --ssl-keyfile /etc/job-queue/tls/tls.key resources: @@ -71,6 +70,10 @@ spec: seccompProfile: type: RuntimeDefault env: + - name: HOME + value: /tmp + - name: UV_CACHE_DIR + value: /tmp/uv-cache - name: JOB_STORE_PATH value: /app/data/jobs.db envFrom: