Spaces:
Runtime error
Runtime error
Commit History
-
fix(deploy): use offline validator profile for HF Spaces
Aaron BrownHF Spaces runs in subprocess mode without Docker. The training validator profile requires Docker for build_boot, exploitability, and evidence checks. Switch to offline profile which runs only graph-based and structural checks.f984690 -
Enforce strict live admission defaults in managed runtime (#90)
Lars TalianUnverified signatureb33db9f -
Fix service startup in containers
Aaron Brown- service_manifest.py: Add container-compatible init_commands (disable imklog for rsyslog, ensure MySQL data dir, postfix aliases) - environment.py: Add zombie reaper for PID 1, isolate service processes with start_new_session=True - Dockerfile: Clear stale snapshots so runtime regenerates with current service specs48525dd -
Refactor Dockerfiles to staged official uv builds (#76)
Lars TalianUnverified signature3794dd6 -
Add Gradio range dashboard and enable web interface
Aaron Brown- Add custom Gradio tab with network topology, reward bars, flag status - Mount at /web via gr.mount_gradio_app (compatible with installed openenv) - Add gradio>=4.0.0 to dependencies - Set ENABLE_WEB_INTERFACE=true in Dockerfileaef9d26 -
Enable managed runtime for HF Space deployment
Aaron Brown- Set OPENRANGE_RUNTIME_MANIFEST in Dockerfile to activate the snapshot runtime so reset() boots real services (MySQL, nginx, slapd, etc.) from the tier1 manifest via TemplateOnlyBuilder - Set validator profile to offline (no Docker needed on HF) - Increase LLM builder timeout from 120s to 600s (Azure codex needs it)2968b9c -
Fix service ordering: start daemons before loading SQL/data
Aaron Brown- Start services BEFORE applying snapshot so MySQL/LDAP are ready to receive SQL/LDIF payloads during file deployment - Auto-create databases referenced by USE statements in snapshot SQL - Add smbclient to Dockerfile for agent SMB enumerationc019c91 -
Fix uv sync: set UV_PROJECT_ENVIRONMENT so deps install into venv
Aaron Browna2ba18c -
Snapshot-driven service lifecycle, fix Bookworm build
Aaron Brown- Dockerfile: remove nikto/hydra (not in Debian repos), install sqlmap via pip, start only uvicorn at boot (no hardcoded services) - start.sh: now snapshot-driven — reads spec.json topology.hosts to determine which services to start per episode. Called by reset(), not at container boot. - Removes hardcoded infra assumptions — services scale with manifest58f7026 -
Fix HF Space build: switch to python:3.11-slim-bookworm base
Aaron Browndeadsnakes PPA gpg import fails in HF build sandbox. Use python:3.11-slim-bookworm which ships Python 3.11 natively. Also handle MariaDB (Bookworm default) in start.sh and fix uvicorn module path to open_range.server.app.8691b5f -
Switch to single-stage Ubuntu 22.04 build with Python 3.11 PPA
Aaron Brown50e0b84 -
Fix runtime errors: Python path, MySQL perms, PHP-FPM detection
Aaron Brown- Use same base image for builder and runtime (Python 3.11 compat) - Use python3 -m uvicorn instead of venv shebang - Auto-detect PHP-FPM binary name (varies by distro) - Fix MySQL log directory permissions (chown mysql:mysql) - Create /var/run/mysqld with correct ownership at build time - Remove set -e so service timeouts don't kill startup8b07a89 -
Production all-in-one container with real service execution
Aaron Brown- Replace mock mode with subprocess execution for production - Add execution_mode parameter: auto/docker/subprocess - Auto-detect: env var OPENRANGE_EXECUTION_MODE > Docker SDK > subprocess - Subprocess mode executes commands via bash against local services - _apply_snapshot_subprocess() writes files directly to filesystem - Add zone_router.py: Python zone routing replaces iptables - All-in-one Dockerfile: ubuntu:22.04 + nginx, php-fpm, mysql, slapd, rsyslog, samba, postfix, nmap, sqlmap, hydra, nikto, etc. - start.sh: follows OpenEnv openapp_env pattern (bg services + exec uvicorn) - HEALTHCHECK with 60s start-period for service boot time - Unit tests preserved: docker_available=False still uses mock mode - 689 tests passing49d1c75 -
Add root Dockerfile for HF Spaces Docker SDK detection
Aaron Brown1b7d6f1 -
LLM Builder pipeline: GPT 5.2 Codex generation + production templates
Aaron Brown- Builder: handle codex models (no temperature), add JSON keyword to user message for response_format compatibility, max_tokens=32768 - Prompts: complete rewrite with Docker infrastructure context, static IPs, files dict spec, anti-patterns, completeness checks - Templates: production-quality Jinja2 for procedural generation - docker-compose: static IPs, NET_ADMIN attacker with tools/routing, mysql_native_password, web on dmz+internal+management, healthchecks - Dockerfile.web: php8.1 packages, /var/www/portal, proper FPM socket - Dockerfile.db: referral_db, native password auth - nginx.conf: /var/www/portal, php8.1-fpm.sock, conditional endpoints - init.sql: referral_db schema (patients, referrals, billing, etc.) - iptables: hardcoded zone rules + manifest overrides - Environment: _apply_snapshot() deploys LLM files dict to containers, container name discovery via Docker listing - Delete static Docker infrastructure (docker-compose.yml, docker/, Dockerfile) — in…3d5d7e9 -
fix: align package with openenv contract
Lars Talianfda4cbc