[DEPR]: Local codejail

[robrap]

Proposal Date

2025-04-30

Target Ticket Acceptance Date

TBD

Earliest Open edX Named Release Without This Functionality

Ulmo - 2025-10

Rationale

The capability of using codejail for problems with code execution is not going away. This DEPR is for removing the ability to run this locally as part of edx-platform, in favor of running remotely in a new codejail-service.

Using the new service for code execution is more secure, most especially because if anyone were able to break out of the layers of security, they would not be executing code on the same box as the LMS, which has access to data which is important to keep secure. Keeping code execution in another service entirely also allows additional layers of security that would not be possible when colocated with the LMS, such as preventing all outbound network connections.

Removal

The local codejail allows unsafe execution (non-sandboxed) for configured courses. This functionality will likely not be carried over to the new remote service.

The darklaunch feature, which enables one to choose between local and remote, is a good starting place to find all of the local codejail code that can be removed. See this github search for locations.

Replacement

The replacement is the new codejail-service.

Note: 2U/edX is running this in production.

Deprecation

The legacy local calls could be marked as deprecated when someone moves this ticket forward.

Migration

A darklaunch capability was added so that the new remote codejail-service could be tested and tuned in production without causing issues. Once all is well, edx-platform configuration can be updated to switch users to the new service.

See https://docs.openedx.org/projects/edx-platform/en/latest/references/featuretoggles.html#featuretoggle-ENABLE_CODEJAIL_DARKLAUNCH

Additional Info

No response

Task List

• Complete readiness of new replacement codejail-service
• Make codejail-service Tutor plugin
• Duplicate requirements in new codejail-service. It currently uses this defined in edx-platform to avoid duplication.
• Remove local capability for codejail, including current darklaunch feature. Note: there are ideas for future darklaunch features for Python upgrades, but that must be handled differently.
• Consider whether this is the last remaining OS-specific functionality in edx-platform, and if we could update workflows to use ubuntu-latest like in this PR: build: updated ubuntu version to latest edx/edx-platform#75.

[robrap]

[inform] This DEPR is in the Draft state. It can't move forward without a DEPR coordinator to help update it to match the updated DEPR template. No action is required, unless anyone wants to move this out of Draft.

[MoisesGSalas]

To clarify a little bit more regarding the codejail-service plugin. We plan to provide support for the new codejail service in the current eduNEXT/tutor-contrib-codejail plugin. The idea would be to support both implementations during ulmo (edunext's and 2U's) and eventually transition to the openedx/codejail-service in verawood.

[robrap]

Thanks @MoisesGSalas. Note that this DEPR was documented, but never announced, because it doesn't yet have an owner. Do you have interest in owning this DEPR and following up with legacy removal in Verawood?

[MoisesGSalas]

@robrap, I can take on that. It would be mostly the announcement and updating this ticket accordingly?

[robrap]

@MoisesGSalas: See the Task List under this issue's description. We need someone to take on responsibility for that DEPR work as a prerequisite to announcing.

[feanil]

@MoisesGSalas are you working on this?

[MoisesGSalas]

@feanil, I had this frozen for a while, but I can take on it next week. I would like little bit of clarification though:

When @robrap says "We need someone to take on responsibility for that DEPR work as a prerequisite to announcing." It doesn't mean fulfilling the checklist is a requirement for the announcement, right? It means that I will make sure it gets done by the Verawood release.

[robrap]

When @robrap says "We need someone to take on responsibility for that DEPR work as a prerequisite to announcing." It doesn't mean fulfilling the checklist is a requirement for the announcement, right? It means that I will make sure it gets done by the Verawood release.

That is correct, @MoisesGSalas. A requirement for announcing is simply to have someone willing to take the DEPR forward. Since you are willing to do that, you are free to start the process (via announcing) whenever you are ready. Thank you!

[feanil]

@MoisesGSalas if you're doing the work, I can help with the DEPR part of the process of communicating this. It sounds like you're ready to start on this work? Do you want me to go ahead and do the comms?