Enable workspaces

Chat starts each person's workspace as a pod and a volume, runs commands in it through the Kubernetes API and proxies its preview. With deploy/k8s.yaml from the Kubernetes install, there is nothing more to set up. The manifest gives Chat a ServiceAccount and a Role for pods, exec and volumes in its own namespace, plus NetworkPolicies so that only Chat reaches those pods and they reach only DNS and public HTTP and HTTPS addresses. The namespace enforces Pod Security restricted, so the API server refuses privileged, root or host-network pods there.

Administrators see Compute › Workspaces, a chat can get a workspace, and projects get a Research tab. Chat checks its permissions when it starts; Settings › Administration › System shows whether workspaces are on and, if they are off, why.

To leave workspaces out, set OBLETH_CHAT_WORKSPACES=off. Outside a cluster, Chat reaches the API server with OBLETH_CHAT_KUBE_API, OBLETH_CHAT_KUBE_TOKEN_FILE and OBLETH_CHAT_KUBE_CA_FILE and a namespace from OBLETH_CHAT_SANDBOX_NAMESPACE, for local development.

Run workspaces under gVisor

gVisor runs each pod against its own user-space kernel, so code in a workspace never talks to the node's kernel directly. It is set up per node.

1. 1

   Install gVisor on the nodes for workspaces

   Install runsc and containerd-shim-runsc-v1 and add the runsc runtime to containerd, as in gVisor's containerd guide. Label those nodes, for example gvisor=installed.

2. 2

   Add a RuntimeClass

   apiVersion: node.k8s.io/v1
   kind: RuntimeClass
   metadata:
     name: gvisor
   handler: runsc
   scheduling:
     nodeSelector:
       gvisor: installed
   

3. 3

   Point Chat at it

   Set OBLETH_CHAT_SANDBOX_RUNTIME_CLASS=gvisor and restart Chat. Workspace and browser pods then start only on the labelled nodes. Their volumes must be able to attach there, so pick a StorageClass that reaches those nodes (OBLETH_CHAT_SANDBOX_STORAGE_CLASS).

Add previews

A workspace's apps open in its Preview tab, served at <id>.<domain>. Without a preview domain everything else works: workspaces, the terminal, files, code and the browser.

Create a wildcard DNS record and a wildcard certificate for the domain, route it to Chat through your ingress, and set OBLETH_CHAT_PREVIEW_DOMAIN. The domain must not contain Chat's own origin.

Only Chat's own page can open a preview, and preview access lasts as long as the sign-in it came from: signing out, a revoked session, a disabled account or lost workspace access ends it within seconds. The preview cookie lasts an hour, renewed while the person is signed in.

OBLETH_CHAT_PREVIEW_DOMAIN=sbx.example.edu

Keep workspaces in their own namespace

deploy/k8s-workspaces.yaml creates an obleth-sandboxes namespace with the same Role for Chat's ServiceAccount, a ResourceQuota and default-deny NetworkPolicies. Apply it after deploy/k8s.yaml, then set OBLETH_CHAT_SANDBOX_NAMESPACE=obleth-sandboxes.

Settings

The browser

With workspaces on, each person also gets a browser: a headless Chromium in a second pod with a small volume for its profile, in the same namespace and under the same access rule (OBLETH_CHAT_SANDBOX_ACCESS). Browser pods carry the workspace labels, so the same NetworkPolicies apply: only Chat connects (to DevTools on port 9222), and they reach only public HTTP and HTTPS addresses.

A browser's profile volume is deleted after the workspace retention (OBLETH_CHAT_SANDBOX_RETENTION_MINUTES) without use.