codenow / api-server Goto Github PK

Right now, API errors with 'no such container' in case project container for current user becomes un-available for some reason, which is not implemented on UI, directly affecting the UX.
We need to attempt container re-creation, or show proper error on UI.

We need a central API routes document. Swagger will be the preferred tool.

Since we are not using any, lets remove any external service integration. So far I see the following:

datadog
mailchimp 
newrelic
rollbar 

Excerpted from CircleCI (https://circleci.com/gh/CodeNow/api-server/2243)

[node_modules/mocha/lib/reporters/base.js:309]  1 failing

[node_modules/mocha/lib/reporters/base.js:204]  1) Channels GET /channels channel badges "before each" hook:
     Error: expected 200 "OK", got 500 "Internal Server Error"
      at Test.assert (/home/ubuntu/api-server/node_modules/supertest/lib/test.js:145:15)
      at /home/ubuntu/api-server/node_modules/supertest/lib/test.js:120:10
      at Test.Request.callback (/home/ubuntu/api-server/node_modules/supertest/node_modules/superagent/lib/node/index.js:654:30)
      at Test.<anonymous> (/home/ubuntu/api-server/node_modules/supertest/node_modules/superagent/lib/node/index.js:131:10)
      at Test.EventEmitter.emit (events.js:95:17)
      at IncomingMessage.<anonymous> (/home/ubuntu/api-server/node_modules/supertest/node_modules/superagent/lib/node/index.js:802:12)
      at IncomingMessage.EventEmitter.emit (events.js:117:20)
      at _stream_readable.js:920:16
      at process._tickDomainCallback (node.js:459:13)

If we can scan the uploaded file before commiting to image, it can be of big help against known malicious content being run off a container:
https://github.com/kylefarris/clamscan

Implement container limits as listed in this doc https://github.com/CodeNow/orchestrator/wiki/container_limits

user can signup with duplicate email account just by changing the character case.

File "/home/ubuntu/api-server/src/models/volumes.coffee", line 128 col 44 in Request._callback
if res.statusCode isnt 201 then cb error res.statusCode, res.body.message else

Add supporting API routes for CodeNow/runnable-web#134

Search and remove all duplicate accounts which might be affected with the bug: #146

For long running user sessions we have to add support for recreating containers, in case start fails with 'no such container'.

the email to the user is being sent, however the moderators are not getting the emails. the configs.SES.moderators is set, and it even worked on a local test, but I do not see the error that I am hitting... something just must not be set right?

cleanContainers function doesn't seems to be working well for containers. Lets fix that and while at it, switch all deletion to it. This will essentially mean delayed deletion, however that should be fine.

Docklet task - CodeNow/docklet#40

Redis is single threaded, hence maxing out at one core at all times.
This may be an immediate performance bottleneck.

We must need some cleanup so anything un-necessary is cleaned up, and implement Redis partitioning if the cleanup is not enough.

This task may also help a bit:
CodeNow/runnable-web#132

This is a placeholder issue for docker 1.10 (remote API v1.22) compatibility:
https://blog.docker.com/2016/02/docker-1-10/
https://docs.docker.com/engine/reference/api/docker_remote_api/#v1-22-api-changes

@EnosFeedler
I suspect some of your code just needs to be merged in
https://rollbar.com/item/272358970/

Users with unverified emails will have these limitations:

• Unverified (not Guest) users will not be allowed to do publish
• Unverified (not Guest) users will not be allowed to change code and then run
• Unverified (as well as Guest) users will not have access to container terminal

web task ref CodeNow/runnable-web#149

We have a bit too many entries in users table(36566066 on last count), which un-necessarily contribute to slow down the recovery process, and are just not necessary as most of them are un-registered users.

The running container list in admin UI is not showing containers from all docks.

For better interaction with users of the platform, we plan to implement discourse forum. This however needs Oauth2 for SSO, which is being covered in another task

Instead of checking if the user is the owner we should check if the user has permission to view edit etc . . . so that we can inject admin privileges.

To stay on top of abuse, API can send alerts on any images with name having suspicious names like hacker, cracker, dos, ddos, etc, so they can be proactively looked into