chore: Update tmpfs configuration and directory structure in Docker setup

- Added a temporary filesystem configuration for /tmp with size and mode settings in both Docker Compose files.
- Changed the directory for empty_proc from /tmp to /var/lib/code-interpreter in the Dockerfile and related service files.
- Updated the sandbox execution commands to reflect the new empty_proc path and incorporated dynamic tmpfs size settings.

Author: usnavy13

Dockerfile

@@ -233,7 +233,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # ============================================
 RUN mkdir -p /var/lib/code-interpreter/sandboxes && \
     mkdir -p /mnt/data && \
-    mkdir -p /tmp/empty_proc
+    mkdir -p /var/lib/code-interpreter/empty_proc
 
 RUN groupadd -g 1001 codeuser && \
     useradd -u 1001 -g codeuser -m codeuser && \

docker-compose.prod.yml

@@ -30,6 +30,7 @@ services:
       # to the mounted files inside the container under /app/ssl.
       - ${SSL_CERTS_PATH:-./ssl}:/app/ssl:ro
     tmpfs:
+      - /tmp:size=512m,mode=1777
       - /app/data:size=100m
     depends_on:
       redis:

docker-compose.yml

@@ -30,6 +30,7 @@ services:
       # to the mounted files inside the container under /app/ssl.
       - ${SSL_CERTS_PATH:-./ssl}:/app/ssl:ro
     tmpfs:
+      - /tmp:size=512m,mode=1777
       - /app/data:size=100m
     depends_on:
       redis:

src/services/programmatic.py

@@ -186,6 +186,8 @@ async def start_execution(
                 shlex.quote(str(a)) for a in [settings.nsjail_binary] + nsjail_args
             )
 
+            tmpfs_size = settings.sandbox_tmpfs_size_mb
+
             wrapper_cmd = (
                 f"mount --bind {shlex.quote(str(sandbox_info.data_dir))} /mnt/data && "
                 f"mount -t tmpfs -o size=1k tmpfs /var/lib/code-interpreter/sandboxes && "
@@ -194,7 +196,9 @@ async def start_execution(
                 f"mount -t tmpfs -o size=1k tmpfs /app/ssl && "
                 f"mount -t tmpfs -o size=1k tmpfs /app/dashboard && "
                 f"mount -t tmpfs -o size=1k tmpfs /app/src && "
-                f"mount --bind /tmp/empty_proc /proc && "
+                f"mount --bind /var/lib/code-interpreter/empty_proc /proc && "
+                # BUG-007: Ephemeral /tmp — prevent cross-session data persistence
+                f"mount -t tmpfs -o size={tmpfs_size}m,mode=1777 tmpfs /tmp && "
                 f"{nsjail_cmd}"
             )
 

src/services/sandbox/executor.py

@@ -103,7 +103,11 @@ async def execute_command(
             if lang in ("java", "rs", "bash"):
                 proc_mask = ""
             else:
-                proc_mask = "mount --bind /tmp/empty_proc /proc && "
+                proc_mask = (
+                    "mount --bind /var/lib/code-interpreter/empty_proc /proc && "
+                )
+
+            tmpfs_size = settings.sandbox_tmpfs_size_mb
 
             wrapper_cmd = (
                 # Bind sandbox dir to /mnt/data (before hiding sandboxes dir)
@@ -120,6 +124,8 @@ async def execute_command(
                 f"mount -t tmpfs -o size=1k tmpfs /app/src && "
                 # BUG-003: Hide /proc (except Java which needs /proc/self/exe)
                 f"{proc_mask}"
+                # BUG-007: Ephemeral /tmp — prevent cross-session data persistence
+                f"mount -t tmpfs -o size={tmpfs_size}m,mode=1777 tmpfs /tmp && "
                 # Execute nsjail
                 f"{nsjail_cmd}"
             )

src/services/sandbox/pool.py

@@ -390,6 +390,8 @@ async def _start_repl_process(
             nsjail_cmd = " ".join(
                 shlex.quote(str(a)) for a in [settings.nsjail_binary] + nsjail_args
             )
+            tmpfs_size = settings.sandbox_tmpfs_size_mb
+
             wrapper_cmd = (
                 # Bind sandbox dir to /mnt/data (before hiding sandboxes dir)
                 f"mount --bind {shlex.quote(str(sandbox_info.data_dir))} /mnt/data && "
@@ -404,7 +406,9 @@ async def _start_repl_process(
                 f"mount -t tmpfs -o size=1k tmpfs /app/dashboard && "
                 f"mount -t tmpfs -o size=1k tmpfs /app/src && "
                 # BUG-003: Hide /proc (REPL is Python-only, always safe to mask)
-                f"mount --bind /tmp/empty_proc /proc && "
+                f"mount --bind /var/lib/code-interpreter/empty_proc /proc && "
+                # BUG-007: Ephemeral /tmp — prevent cross-session data persistence
+                f"mount -t tmpfs -o size={tmpfs_size}m,mode=1777 tmpfs /tmp && "
                 # Execute nsjail
                 f"{nsjail_cmd}"
             )