.env.example

PORT=6969

MAX_WORKERS=10

DOCKER_TIMEOUT_MS=5000
DOCKER_MEMORY_LIMIT=128m
DOCKER_CPU_PERIOD=100000
DOCKER_CPU_QUOTA=50000

# Max process/thread count per sandbox (cgroups pids controller) — guards
# against fork bombs. Raise if a runtime is thread-heavy (e.g. the JVM).
DOCKER_PIDS_LIMIT=256

# Max bytes captured per stream (stdout, stderr). Output beyond this is
# discarded and the result is flagged output_truncated — prevents a runaway
# program's output from exhausting the worker's memory.
MAX_OUTPUT_BYTES=1048576

# Experimental: mount the container root filesystem read-only. When enabled, a
# writable tmpfs of DOCKER_TMPFS_SIZE_MB is mounted at /tmp. Note: compiled
# languages that write build artifacts into /app may fail under a read-only
# rootfs, so this defaults off.
DOCKER_READONLY_ROOTFS=false
DOCKER_TMPFS_SIZE_MB=64

REDIS_URL=redis://localhost:6379

# Optional: enables job history persistence and the /dashboard/jobs endpoint
DATABASE_URL=

# Optional: comma-separated keys; leave empty to disable auth
API_KEYS=

# Optional: "runsc" runs sandboxes under gVisor for kernel-level isolation.
# Requires gVisor installed and registered as a Docker runtime on the host
# first — see "Sandbox Runtime: gVisor" in README.md.
DOCKER_RUNTIME=

# Experimental: "docker" (default) or "native". Native skips Docker entirely
# and runs jobs via Linux namespaces + cgroups v2 — see "Sandbox Backends:
# Native (Experimental)" in README.md before using this.
SANDBOX_BACKEND=docker

# Native backend only — base directory for per-job temp dirs.
NATIVE_WORKDIR=

# Native backend only — UID/GID to drop the sandboxed process to before exec.
# Requires the worker to run as root. Leave at 0 to run as the worker's own user.
NATIVE_UID=0
NATIVE_GID=0

# OPTIONAL performance: warm container pool (docker backend only). Default OFF.
# When enabled, keeps WARM_POOL_SIZE pre-started, fully hardened idle containers
# per hot language and runs each job via `docker exec` to skip create+start
# latency. Each container is used for one job then replaced, so isolation is
# effectively per-run — but the default (OFF) create-per-run path is the most
# pristine, so leave this off unless you have validated it against live Docker.
WARM_POOL_ENABLED=false
WARM_POOL_SIZE=0