I have seen various references to codejail and see it purports to be required for a few things. In the context of a reasonably locked down kubernetes, is there some link/document with an explanation of the security benefits it provides for system security in addition to that you can set up in kubern…

In the original design, codejail was run on the same host as the LMS, which meant it had to be very locked down. Additionally, running student code was indeed a desirable feature – some instructor Python explicitly executes student-submitted code as part of grading the code. Moving to Kubernetes ju…

There are a couple of paragraphs in the README that should shed some light on the design . Otherwise, the question you need to ask yourself is: as an operator, how much do I want to isolate the running of completely arbitrary Python code (as in, code that literally any learner can submit from a cour…

Thanks very much for the reply, and I can certainly understand the use case when running on bare metal. I’m sure there have been many happy users for a while too! But it’s also true that Amazon, Google, Microsoft, Oracle, Alibaba… let you execute completely arbitrary code in any language on their ha…

[image] AntonOfTheWoods: I definitely missed that part in the docs - can you point me to the docs/discussion? This was developed way-back-when in the edx.org days. Not sure there’s any public discussion or even design documents available. @dave ? Anyway, what I am aware of is documentation …

Another way to think about it is that yes, AWS lets you run arbitrary code on their servers, but they have to deal with any legal and reputation consequences when a bad actor abuses their service. You probably don’t want to give your Open edX installation that risk exposure. :slight_smile:

Thanks for the info. In 2025 I would definitely try and do Python in the browser rather than execute it on my app server… GitHub - pyscript/pyscript: PyScript is an open source platform for Python in the browser. Try PyScript: https://pyscript.com Examples: https://tinyurl.com/pyscript-examples Comm…

Yep, in-browser is certainly a thing you could do, but it would allow the student to see the instructor’s code, which sometimes contains answers. Kubernetes does allow for locking things down more than I described, but not within a container—it only allows constraining the container as a whole. Wha…

[image] Tim_McCormack: Yep, in-browser is certainly a thing you could do, but it would allow the student to see the instructor’s code, which sometimes contains answers. I do agree it would take some thought, notably “well designed data in/outflows”. My basic point is that the only reason I se…

[image] AntonOfTheWoods: the only reason I see for a codejail over a browser-based solution is if you want the injected code to be able to access some raw resources directly on the server As I see it, there is also the question of client-side versus server-side validation. No matter how well…

[image] arbrandes: WASM has been brought up in the past as something we could leverage, yes Found it . It’s a server-side POC, though. But it doesn’t require AppArmor, so it should be easier to deploy.

Codejail on kubernetes?

Site Operators

arbrandes (Adolfo R. Brandes) September 25, 2025, 12:37pm 11

Found it.

It’s a server-side POC, though. But it doesn’t require AppArmor, so it should be easier to deploy.

Topic		Replies	Views
Sandboxing Instructor Code with WebAssembly (instead of codejail) Development	11	1050	May 19, 2023
ADR for WebAssembly-based code sandboxing Architecture	4	279	November 22, 2023
Deprecation/Removal: Local codejail Deprecation	1	30	March 11, 2026
K8S support for tutor-contrib-codejail Site Operators tutor , tutor-plugin	0	369	July 2, 2022
Virtual programming lab in Open edX Site Operators	1	798	June 29, 2020

Codejail on kubernetes?

Related topics