Configuration reference

Configuration is entirely environment-variable driven. The Compose files inline development defaults; .env.example in the repository root is the annotated template to copy from.

Core mode

Authentication

See Authentication for the full setup.

Internal secrets

Execution manifests

Redis

Object storage

Despite the names, any S3-compatible endpoint works; the file server also supports IRSA authentication on EKS.

Sandbox runner

microVM launcher

Timeouts

A request may pass run_timeout (ms) to cap its own run. It is clamped down to MAX_RUN_TIMEOUT, and again to the runner's SANDBOX_RUN_TIMEOUT: a caller can only narrow the deployment's ceiling, never raise it. Setting MAX_RUN_TIMEOUT above JOB_TIMEOUT has no effect, since a run that outlives the waits watching it is the failure this ordering exists to prevent. Raise JOB_TIMEOUT instead.

curl -sX POST http://localhost:3112/v1/exec \
  -H 'Content-Type: application/json' \
  -d '{"lang":"py","code":"while True: pass","run_timeout":3000}'

The limit is enforced by NsJail's --time_limit, which takes whole seconds and is rounded up, so a run can overshoot the requested value by up to one second (never more, and never less than asked): run_timeout: 1001 permits two seconds.

A run that exceeds its budget is a successful HTTP response describing a killed process, not an error:

{ "status": "TO", "code": 137, "signal": "SIGKILL", "stdout": "", "stderr": "" }

The three layers are deliberately staggered by JOB_WAIT_GRACE_MS: the sandbox kills the run, the worker waits one grace longer than everything the sandbox does with the job, and the API waits one grace longer than the worker. Each layer therefore outlives the one it is waiting on, so the structured timeout above propagates to the caller instead of racing an outer give-up and surfacing as a generic 500. Raise JOB_TIMEOUT and the rest follow automatically.

A sandbox spends its budget in sequence, not in parallel, so the worker's layer has to cover the sum of every phase:

The sandbox does not answer when the run ends: it still has to walk the workspace and upload artifacts. The post allowance is sized for ordinary output, not for the pathological case where every one of SANDBOX_MAX_OUTPUT_FILES hits its own 30-second upload timeout (with the defaults, ceil(50/8) * 30s = 210s, which means the file server is broken rather than busy). Raise it if a deployment routinely emits many large artifacts.

Most of these are the runner's variables. The service reads them to size its own layers, so if you raise one on the runner, set it on the API and worker too, or those layers under-provision by the difference. The shipped Compose files and Helm chart already forward all of them to every process that computes the ladder.

Worker concurrency

Python gets its own queue and a lower default because scientific workloads are heavier. See Operations.

Rate limits

Applied per principal on the API.

Language runtimes

Downloads are verified against SHA-256 checksums pinned for the default versions. Override a version and package_init verifies against the provider's published checksum file instead; set the matching *_SHA256 to pin your own.

Persistent sessions

Off by default. See Persistent sessions.

Dynamic dependencies

Off by default. See Dynamic dependencies.

Service URLs

Set by the Compose files and the chart; override only for custom topologies.

Telemetry

OpenTelemetry tracing, off by default. On Kubernetes set otel.enabled=true.