fix: add ace-backend readonly (#198)

langchain-ai · Dec 10, 2024 · 3d73025 · 3d73025
1 parent 97fe691
commit 3d73025
Show file tree

Hide file tree

Showing 2 changed files with 48 additions and 16 deletions.
diff --git a/charts/langsmith/ci/readonly-config-values.yaml b/charts/langsmith/ci/readonly-config-values.yaml
@@ -3,6 +3,32 @@ config:
   langsmithLicenseKey: "YOUR_LICENSE_KEY"
   apiKeySalt: "YOUR_API_KEY_SALT"
 
+aceBackend:
+  deployment:
+    resources:
+      requests:
+        cpu: 100m
+        memory: 500Mi
+    podSecurityContext:
+      runAsNonRoot: true
+      runAsUser: 1000
+      runAsGroup: 1000
+      fsGroup: 1000
+    securityContext:
+      capabilities:
+        drop:
+          - ALL
+      seccompProfile:
+        type: RuntimeDefault
+      allowPrivilegeEscalation: false
+      readOnlyRootFilesystem: true
+    volumes:
+      - name: tmp
+        emptyDir: {}
+    volumeMounts:
+      - name: tmp
+        mountPath: /app/node_modules
+
 backend:
   deployment:
     resources:

diff --git a/charts/langsmith/examples/read_only_config.yaml b/charts/langsmith/examples/read_only_config.yaml
@@ -3,12 +3,30 @@ config:
   langsmithLicenseKey: "YOUR_LICENSE_KEY"
   apiKeySalt: "YOUR_API_KEY_SALT"
 
+aceBackend:
+  deployment:
+    podSecurityContext:
+      runAsNonRoot: true
+      runAsUser: 1000
+      runAsGroup: 1000
+      fsGroup: 1000
+    securityContext:
+      capabilities:
+        drop:
+          - ALL
+      seccompProfile:
+        type: RuntimeDefault
+      allowPrivilegeEscalation: false
+      readOnlyRootFilesystem: true
+    volumes:
+      - name: tmp
+        emptyDir: {}
+    volumeMounts:
+      - name: tmp
+        mountPath: /app/node_modules
+
 backend:
   deployment:
-    resources:
-      requests:
-        cpu: 100m
-        memory: 500Mi
     podSecurityContext:
       runAsNonRoot: true
       runAsUser: 1000
@@ -25,10 +43,6 @@ backend:
 
 frontend:
   deployment:
-    resources:
-      requests:
-        cpu: 100m
-        memory: 500Mi
     podSecurityContext:
       runAsNonRoot: true
       runAsUser: 1000
@@ -51,10 +65,6 @@ frontend:
 
 platformBackend:
   deployment:
-    resources:
-      requests:
-        cpu: 100m
-        memory: 500Mi
     podSecurityContext:
       runAsNonRoot: true
       runAsUser: 1000
@@ -78,10 +88,6 @@ platformBackend:
 
 playground:
   deployment:
-    resources:
-      requests:
-        cpu: 100m
-        memory: 500Mi
     command:
       - "yarn"
       - "start"