feat!: support for verawood

Author: MoisesGSalas

CHANGELOG.md

@@ -13,6 +13,27 @@ See the fragment files in the [changelog.d/ directory](./changelog.d).
 
 <!-- scriv-insert-here -->
 
+<a id='changelog-22.0.0'></a>
+## 22.0.0 — 2026-08-12
+
+### Added
+
+- Support for the Verawood release.
+
+### Changed
+
+- The default AppArmor Profile now requires AppArmor 4, which available on
+  ubuntu 24.04 or newer.
+- AppArmor enforcement is now a requirement and can not be turned off.
+- The container name and internal services for kubernetes and docker was changed
+  from `codejailservice` to `codejail`.
+
+### Removed
+
+- Support for the old remote service implementation of codejail service
+  ([codejailservice](https://github.com/edunext/codejailservice.git)] has been
+  dropped.
+
 <a id='changelog-21.0.1'></a>
 ## 21.0.1 — 2026-05-08
 
@@ -25,7 +46,7 @@ See the fragment files in the [changelog.d/ directory](./changelog.d).
 ## 21.0.0 - 2025-11-04
 
 - feat!: add support for the Ulmo release
- 
+
   This changes also include support for openedx/codejail-service as an
   alternative implementation of the safe_exec REST API.
 
@@ -44,14 +65,14 @@ See the fragment files in the [changelog.d/ directory](./changelog.d).
   appropriate labels.
 
 - feat: use an "init service" to load the apparmor profile (#63)
- 
+
   This follows the same logic as the "permissions" service used by tutor
   core. The `codejail-apparmor-loader` service runs the command used
   previously by the init job.
- 
+
   It makes more sense to handling loading of the apparmor profile with an
   init service:
- 
+
   - The profile is ephemeral, rebooting the host will require to load it
     again.
   - The profile is a dependency for the container to start. Things like
@@ -147,7 +168,7 @@ See the fragment files in the [changelog.d/ directory](./changelog.d).
 - Add support for Olive release (#28).
 - Adds mantainer group.
 
-## 14.1.0 - 2022-09-26 
+## 14.1.0 - 2022-09-26
 
 ### Added
 
@@ -163,14 +184,14 @@ See the fragment files in the [changelog.d/ directory](./changelog.d).
 
 - Bump version according tutor practices for Nutmeg release.
 
-## 13.0.0 - 2022-05-02 
+## 13.0.0 - 2022-05-02
 
 ### Added
 
 - Add repo documentation.
 - Bump version according tutor practices for Maple release.
 
-## 12.0.2 - 2022-04-29 
+## 12.0.2 - 2022-04-29
 
 ### Added
 

README.md

@@ -7,17 +7,6 @@ This plugin configures and runs a remote CodeJail Service instance that
 implements the safe-exec API used by the Open edX platform to offer more
 advanced capabilities to course authors.
 
-Starting from the Ulmo release, the codejail plugin is transitioning to an
-alternative implementation of the safe-exec API (
-[Codejail Service V2](https://github.com/openedx/codejail-service)). You can
-opt-in to use this new implementation on Ulmo before it finally becomes the
-default on the Verawood release.
-
-> [!NOTE]
-> The new CodeJail Service implementation is based on Django instead of Flask,
-> therefore settings changed with the `codejail-*-settings` patches must be
-> adjusted accordingly.
-
 ## Installation
 
 To install the latest version, run:
@@ -47,38 +36,35 @@ aa-enabled
 To customize the configuration, update the following settings in Tutor:
 
 - `CODEJAIL_APPARMOR_DOCKER_IMAGE`: (default: `docker.io/ednxops/codejail_apparmor_loader:latest`)
-- `CODEJAIL_DOCKER_IMAGE_V2` : (default: `{{ CODEJAIL_DOCKER_IMAGE }}-v2`)
 - `CODEJAIL_DOCKER_IMAGE`: (default: `docker.io/ednxops/codejailservice:{{__version__}}`)
 - `CODEJAIL_ENABLE_K8S_DAEMONSET` (default: `False`)
-- `CODEJAIL_ENFORCE_APPARMOR` (default: `True`)
 - `CODEJAIL_EXTRA_PIP_REQUIREMENTS` (default: `[]`)
-- `CODEJAIL_SANDBOX_PYTHON_VERSION` (default: `3.11.9`)
-- `CODEJAIL_SERVICE_REPOSITORY` (default: `https://github.com/edunext/codejailservice.git`\`)
+- `CODEJAIL_SANDBOX_PYTHON_VERSION` (default: `3.12`)
+- `CODEJAIL_SERVICE_REPOSITORY` (default: `https://github.com/openedx/codejail-service.git`)
 - `CODEJAIL_SERVICE_VERSION` (default: `{{ OPENEDX_COMMON_VERSION }}`),
-- `CODEJAIL_SERVICE_V2_REPOSITORY`: (default: `https://github.com/openedx/codejail-service.git`)
-- `CODEJAIL_SERVICE_V2_VERSION`: (default: `{{ OPENEDX_COMMON_VERSION }}`)
-- `CODEJAIL_USE_SERVICE_V2`: (default: `False`)
-
-The `CODEJAIL_*_SERVICE_V2` settings are meant to be used only during the Ulmo
-release and will be phased-out during the Verawood release.
-
-To opt-in to the new implementation of the code-exec API set
-`CODEJAIL_USE_SERVICE_V2` to `True` and re-deploy your environment. If you are
-using a a custom image for the codejail service you will need to rebuild
-it with `CODEJAIL_USE_SERVICE_V2` set to `True`.
 
 ### Custom Image
 
 In most cases, you can work with the provided Docker image for the
-release. You will need to build a custom image if you either:
-
-- Need additional packages installed in the sandbox environment. Use the setting
-  `CODEJAIL_EXTRA_PIP_REQUIREMENTS` to define the list of additional packages.
-- Need to run the sandbox environment under a different Python version. The
-  default Python version of the sandbox might get updated between releases,
-  potentially breaking instructor generated code. You can set
-  `CODEJAIL_SANDBOX_PYTHON_VERSION` to an older version to avoid disruption
-  while figuring out a migration plan.
+release. However, there might be cases when a custom image will be necessary:
+
+- If you need additional packages installed in the sandbox environment. Use the
+  setting `CODEJAIL_EXTRA_PIP_REQUIREMENTS` to define the list of additional
+  packages.
+- If you need to run the sandbox environment under a different Python version
+  you can use `CODEJAIL_SANDBOX_PYTHON_VERSION`. This is particularly useful
+  when the sandbox version is upgraded between releases but you need to figure
+  out a migration plan for instructor code.
+- If you need a completely different set of packages in the sandbox virtual
+  environment. In this case you will need to point to a requirements file using
+  the following docker build arguments: `SANDBOX_DEPS_REPO`,
+  `SANDBOX_DEPS_VERSION`, `SANDBOX_DEPS_SRC_DIR` and `SANDBOX_DEPS_SRC_FILE`.
+  Their current default values are
+  `https://github.com/openedx/codejail-service.git`, `{{ OPENEDX_COMMON_VERSION
+  }}`, `requirements/sandbox` and `base.txt`. This will point to
+  https://github.com/openedx/codejail-service/blob/release/verawood.1/requirements/base.txt
+  for the Verawood release. You can provide the arguments to Tutor as follows
+  `tutor images build codejail -a SANDBOX_DEPS_VERSION=ulmo2`.
 
 ## Kubernetes Support
 
@@ -94,10 +80,6 @@ and has successfully loaded the profile.
 You can enable a helper Daemon Set that will load the profile onto all the nodes
 by setting `CODEJAIL_ENABLE_K8S_DAEMONSET` to true.
 
-If you choose to run the service without enforcing the AppArmor profile
-(absolutely discouraged, and not possible on the newer implementation of
-codejail-service), you can set `CODEJAIL_ENFORCE_APPARMOR` to `False`.
-
 More info about this discussion can be found on [this
 issue](https://github.com/eduNEXT/tutor-contrib-codejail/issues/24).
 
@@ -117,8 +99,24 @@ width="725px"}
 In this case, the section\'s content will render correctly and work as
 specified in the instructions of the problem.
 
+## New CodeJail Service implementation
+
+The Ulmo release introduced support for deploying a new
+implementation of the remote CodeJail service (openedx/codejail-service). The
+Verawood release completely removes support for deploying the old version of the
+service (edunext/codejailservice). Users should be mindful of the following
+points when upgrading:
+
+1. The new CodeJail service **requires** AppArmor 4 on the host machine.
+   AppArmor 4 is available on relatively new Debian based distributions (ubuntu
+   24.04, Debian Trixie, etc).
+2. AppArmor enforcement is no longer optional. The new CodeJail service performs
+   startup checks to ensure the sandbox is properly isolated and will not start
+   if the AppArmor profile is not loaded and configured.
+3. The new CodeJail service implementation is based on Django instead of Flask.
+   Any usage of the `codejail-*-settings` must be adjusted accordingly.
+
 ## License
 
 This software is licensed under the terms of the AGPLv3. See the LICENSE
 file for details.
-

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "tutor-contrib-codejail"
-version = "21.0.1"
+version = "22.0.0"
 description = "Codejail plugin for Tutor"
 readme = "README.md"
 license-files = ["LICENSE"]
@@ -9,7 +9,7 @@ authors = [
 ]
 requires-python = ">=3.10"
 dependencies = [
-    "tutor~=21.0"
+    "tutor~=22.0"
 ]
 classifiers = [
     "Development Status :: 3 - Alpha",

tutorcodejail/patches/cms-env

@@ -1,4 +1,4 @@
 ENABLE_CODEJAIL_REST_SERVICE: true
-CODE_JAIL_REST_SERVICE_HOST: "http://{{ CODEJAIL_HOST }}:8550"
+CODE_JAIL_REST_SERVICE_HOST: "http://codejail:8000"
 CODE_JAIL_REST_SERVICE_CONNECT_TIMEOUT: 0.5
 CODE_JAIL_REST_SERVICE_READ_TIMEOUT: 3.5

tutorcodejail/patches/k8s-deployments

@@ -1,27 +1,26 @@
 ---
-{% if CODEJAIL_USE_SERVICE_V2 %}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: codejailservice
+  name: codejail
   labels:
-    app.kubernetes.io/name: codejailservice
+    app.kubernetes.io/name: codejail
 spec:
   selector:
     matchLabels:
-      app.kubernetes.io/name: codejailservice
+      app.kubernetes.io/name: codejail
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: codejailservice
+        app.kubernetes.io/name: codejail
     spec:
       securityContext:
         appArmorProfile: 
           type: Localhost
           localhostProfile: openedx_codejail_service
       containers:
-        - name: codejailservice
-          image: {{ CODEJAIL_DOCKER_IMAGE_V2 }}
+        - name: codejail
+          image: {{ CODEJAIL_DOCKER_IMAGE }}
           ports:
             - containerPort: 8550
           env:
@@ -35,45 +34,6 @@ spec:
         - name: settings-codejail
           configMap:
             name: settings-codejail
-{% else %}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: codejailservice
-  labels:
-    app.kubernetes.io/name: codejailservice
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: codejailservice
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: codejailservice
-    spec:
-      {% if CODEJAIL_ENFORCE_APPARMOR %}
-      securityContext:
-        appArmorProfile: 
-          type: Localhost
-          localhostProfile: docker-edx-sandbox
-      {% endif %}
-      containers:
-        - name: codejailservice
-          image: {{ CODEJAIL_DOCKER_IMAGE }}
-          ports:
-            - containerPort: 8550
-          env:
-            - name: FLASK_APP_SETTINGS
-              value: codejailservice.tutor.ProductionConfig
-          volumeMounts:
-            - mountPath: /openedx/codejailservice/codejailservice/tutor.py
-              name: settings-codejail
-              subPath: tutor.py
-      volumes:
-        - name: settings-codejail
-          configMap:
-            name: settings-codejail
-{% endif %}
 {% if CODEJAIL_ENABLE_K8S_DAEMONSET %}
 ---
 apiVersion: apps/v1

tutorcodejail/patches/k8s-services

@@ -2,13 +2,14 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: codejailservice
+  name: codejail
   labels:
-    app.kubernetes.io/name: codejailservice
+    app.kubernetes.io/name: codejail
 spec:
   type: ClusterIP
   ports:
-    - port: 8550
+    - port: 8000
       protocol: TCP
+      name: http
   selector:
-    app.kubernetes.io/name: codejailservice
+    app.kubernetes.io/name: codejail

tutorcodejail/patches/kustomization-configmapgenerator

@@ -1,17 +1,12 @@
 - name: codejail-profile
   files:
-  - plugins/codejail/apps/profiles/docker-edx-sandbox.profile
   - plugins/codejail/apps/profiles/openedx-codejail-service.profile
   options:
     labels:
         app.kubernetes.io/name: codejail-aa-loader
-- name: settings-codejail
+- name: codejail-settings
   files:
-  {% if CODEJAIL_USE_SERVICE_V2 %}
-  - plugins/codejail/apps/codejail-service-v2/tutor.py
-  {% else %}
   - plugins/codejail/apps/codejail/tutor.py
-  {% endif %}
   options:
     labels:
-        app.kubernetes.io/name: codejailservice
+        app.kubernetes.io/name: codejail

tutorcodejail/patches/lms-env

@@ -1,4 +1,4 @@
 ENABLE_CODEJAIL_REST_SERVICE: true
-CODE_JAIL_REST_SERVICE_HOST: "http://{{ CODEJAIL_HOST }}:8550"
+CODE_JAIL_REST_SERVICE_HOST: "http://codejail:8000"
 CODE_JAIL_REST_SERVICE_CONNECT_TIMEOUT: 0.5
 CODE_JAIL_REST_SERVICE_READ_TIMEOUT: 3.5

tutorcodejail/patches/local-docker-compose-dev-services

@@ -1,8 +0,0 @@
-codejailservice:
-  command: flask run --host 0.0.0.0 --port 8550
-  environment:
-    FLASK_ENV: development
-    FLASK_APP_SETTINGS: codejailservice.tutor.DevelopmentConfig
-  ports:
-    - "8550:8550"
-  restart: unless-stopped

tutorcodejail/patches/local-docker-compose-services

@@ -1,35 +1,16 @@
 #############Codejail service
-{% if CODEJAIL_USE_SERVICE_V2 %}
-codejailservice:
-  image: {{ CODEJAIL_DOCKER_IMAGE_V2 }}
-  ports:
-    - 8550:8550
+codejail:
+  image: {{ CODEJAIL_DOCKER_IMAGE }}
   environment:
     DJANGO_SETTINGS_MODULE: codejail_service.settings.tutor
   security_opt:
     - apparmor:openedx_codejail_service
   volumes:
-    - ../plugins/codejail/apps/codejail-service-v2/tutor.py:/app/codejail_service/settings/tutor.py:ro
-  restart: unless-stopped
-  depends_on:
-    codejail-apparmor-loader:
-        condition: service_completed_successfully
-{% else %}
-codejailservice:
-  image: {{ CODEJAIL_DOCKER_IMAGE }}
-  environment:
-    FLASK_APP_SETTINGS: codejailservice.tutor.ProductionConfig
-  {% if CODEJAIL_ENFORCE_APPARMOR %}
-  security_opt:
-    - apparmor:docker-edx-sandbox
-  {% endif %}
-  volumes:
-    - ../plugins/codejail/apps/codejail/tutor.py:/openedx/codejailservice/codejailservice/tutor.py:ro
+    - ../plugins/codejail/apps/codejail/tutor.py:/app/codejail_service/settings/tutor.py:ro
   restart: unless-stopped
   depends_on:
     codejail-apparmor-loader:
         condition: service_completed_successfully
-{% endif %}
 
 codejail-apparmor-loader:
   image: {{ CODEJAIL_APPARMOR_DOCKER_IMAGE }}