mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Fable 5.1
0d3e6df31c
Archives are gzipped and uploaded in parts of at most 90 MB with per-part digests (edge request limit); pip installs ignore the task venv so transitive dependencies land in products; the verifier sets NODE_PATH and the Java classpath from products when starting the app. Co-Authored-By: Claude Fable 5.1 <[email protected]>
2.4 KiB
2.4 KiB
kube-ax operator constraints
Verified by the operator on 2026-10-05. These constraints apply across all workloads.
- Two workers, one task per worker, at most two tasks in flight cluster-wide. AX has no
queue: a third apply returns
no free workers available. Treat this as back-pressure, retry the same task/lane with 15–30 seconds of jitter until its deadline, and never count it as a sandbox failure or trigger VM fallback. The host dispatcher shares a two-slot reservation across workload instances and long-lived search executors. /and/tmpare RAM-backed and consume the worker's 3 GiB./workspaceis the only disk-backed path, with about 2 GiB usable per task. Executor and verifier entrypoints use/workspace/tmp,/workspace/.npm,/workspace/.m2,/workspace/.composer,/workspace/.pip, and/workspace/.gradlethrough the respective tool environment variables. Builds and extracted checkouts live under/workspacetoo. The default aggregate workspace scratch guard is 2 GiB;OUSAST_SCRATCH_BYTESconfigures it. Exceeding it returnscould_not_build, reasonscratch limit. The guard polls during child execution and checks after exit; it is not an instantaneous filesystem quota or a replacement for the worker memory limit.ousast-engine-search-verify-*tasks have no egress. The requested exception forfiles.because-security.com:443is pending, not operationally verified. They receive a presigned manifest for a gzip level-6 archive containingcheckout/,products/, andspec.json, built/exported by an executor. Compressed archives retain the 1 GiB cap and travel in parts of at most 90 MB, each digest-checked before assembly and extraction under/workspace. OnlyVERIFY_INPUT_URLandRESULT_URLcross the verifier boundary. Verifiers reject build recipes and do not install dependencies or fetch repositories. Executors finish and release their slots before verifier repetitions start. Both task types must be provisioned without model credentials.- All tasks share one public IP. Repository acquisition uses HTTPS git clone from
github.comor archives fromcodeload.github.com, neverapi.github.com. Host-side metadata queries are a separate concern. Search tasks receive checkout archives; executor tool guidance carries the same acquisition rule. Retain the 60-second first-download retry for delayed task egress policy activation.