Log inSign upBook a demo
Tines Stories
  1. Docs
  2. Self-Hosted
  3. Deploying Tines
  4. Docker Compose
  1. Docs
  2. Self-Hosted
  3. Deploying Tines
  4. Docker Compose

Run Script Setup

Last updated Open markdown version

We support running Run Script actions on your infrastructure for self-hosted customers and for cloud customers using tunnels. For general details on the Run Script action, refer to the documentation here.

Overview

Run Script actions are executed locally using tines-command-runner.

Our deployment of tines-command-runner includes two containers:

  1. tines-command-runner

  2. pypi-server(https://github.com/pypiserver/pypiserver)

The tines-command-runner container handles executing scripts.

Usage of pypi-server is optional. The pypi-server acts as a local python package index, making the installation of packages efficient and easily configurable. For details on configuring tines-command-runner, including available environment variables and options for configuring your own custom package index, see our tines-command-runner configuration reference.

Privilege Escalation

The tines-command-runner image generates a unique Linux user for each Tines team using Run Script actions. To ensure each team's scripts are isolated from one another, tines-command-runner uses sudo to switch between these users when running scripts for a particular team.

If your environment restricts privilege escalation by default, you can explicitly grant only the minimum required Linux capabilities to the container.

Required capabilities

  • SETUID

    • Allows the container to change the effective user ID (required for `sudo` to switch users)

  • SETGID

    • Allows the container to change the effective group ID (required for `sudo` to switch groups)

  • AUDIT_WRITE

    • Allows writing to the kernel audit log (required by PAM/sudo for security logging)

Docker Compose Configuration

Step 1. Prepare the docker-compose.yml

Use the below Docker Compose configuration as a starting point for your deployment of tines-command-runner:

services:
  tines-command-runner:
    image: tines/tines-command-runner:latest
    ports:
      - "4400:4400"
    depends_on:
      - pypi-server
    networks:
      - tines-net
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:4400/health"]
      interval: 30s
      retries: 3
      start_period: 10s
      timeout: 10s
    restart: always

  pypi-server:
    image: pypiserver/pypiserver:latest
    hostname: pypi-server
    volumes:
      - python-packages:/data/packages
    expose:
      - "8080"
    networks:
      - tines-net
    command: run -P . -a . /data/packages
    restart: always

volumes:
  python-packages:

networks:
  tines-net:

CPU & Memory for docker-compose:

We recommend configuring resource limits for tines-command-runner to ensure that run script execution doesn't impact other containers on your host. For example, to dedicate 2 of the host's CPU cores and 1GB of memory:

services:
  tines-command-runner:
    mem_limit: 1g
    cpus: '2.0'
Step 2. Run the container via Docker compose
docker compose up -d

Docker Configuration

Adapt the below commands to run tines-command-runner directly via Docker.

docker network create tines-net

docker run -d \
  --name tines-command-runner \
  -p 4400:4400 \
  --network tines-net \
  --health-cmd "curl -f http://localhost:4400/health" \
  --health-interval 30s \
  --health-retries 3 \
  --health-start-period 10s \
  --health-timeout 10s \
  --restart always \
  tines/tines-command-runner:latest

docker run -d \
  --name pypi-server \
  -v python-packages:/data/packages \
  --hostname pypi-server \
  --expose 8080 \
  --network tines-net \
  --restart always \
  pypiserver/pypiserver:latest run -P . -a . /data/packages
Was this helpful?