Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
dotrun
makes use of a Docker image to provide a predictable sandbox for running Node and Python projects.
Features:
package.json
script entrypoints:
dotrun
runs yarn run start
within the Docker containerdotrun foo
runs yarn run foo
within the Docker containerpackage.json
and only run yarn install
when neededrequirements.txt
and only run pip3 install
when needed.env
and .env.local
files.venv
in the project folder for easy access$ dotrun # Install dependencies and run the `start` script from package.json
$ dotrun serve # Run the python app only
$ dotrun clean # Delete `node_modules`, `.venv`, `.dotrun.json`, and run `yarn run clean`
$ dotrun install # Force install node and python dependencies
$ dotrun exec # Start a shell inside the dotrun environment
$ dotrun exec {command} # Run {command} inside the dotrun environment
$ dotrun {script-name} # Install dependencies and run `yarn run {script-name}`
$ dotrun -s {script} # Run {script} but skip installing dependencies
$ dotrun --env FOO=bar {script} # Run {script} with FOO environment variable
$ dotrun -m "/path/to/mount":"localname" # Mount additional directory and run `dotrun`
$ dotrun serve -m "/path/to/mount":"localname" # Mount additional directory and run `dotrun serve`
$ dotrun refresh image # Download the latest version of dotrun-image
$ dotrun --release {release-version} # Use a specific image tag for dotrun. Useful for switching versions
$ dotrun --image {image-name} # Use a specific image for dotrun. Useful for running dotrun off local images
--image
and --release
arguments cannot be used together, as --image
will take precedence over --release
curl
command-line tool (usually pre-installed on macOS and most Linux distributions)To install dotrun simply run:
curl -sSL https://raw.githubusercontent.com/canonical/dotrun/main/scripts/install.sh | bash
After installation, you can verify that dotrun
is installed correctly by running:
dotrun version
If you prefer to install manually or encounter any issues with the installation script, you can install dotrun
using the following steps:
Install pipx
if you haven't already:
brew install pipx
Ensure pipx
is in your PATH:
pipx ensurepath
dotrun
using pipx
:pipx install dotrun
If you experience problems, please open a GitHub issue.
For optimal performance on Docker we recommend enabling a new experimental file sharing implementation called virtiofs. Virtiofs is only available to users of the following macOS versions:
To fully support dotrun in a new project you should do the following:
0.16.0
or greater in requirements.txt
.dotrun.json
and .venv
to .gitignore
start
script in package.json
to do everything needed to set up local development. E.g.:
"start": "concurrently --raw 'yarn run watch' 'yarn run serve'"
gunicorn==20.0.4
to the bottom of requirements.txt
However, once you're ready to completely switch over to dotrun
, simply go ahead and remove the run
script.
The "PR" action builds the Python package and runs a project with dotrun. This will run against every pull request.
All the changes made to the main branch will be automatically published as a new version on PyPI.
To publish a new version manually, run:
docker buildx create --name mybuilder
docker buildx use mybuilder
docker buildx build --push --platform linux/arm/v7,linux/arm64/v8,linux/amd64 --tag canonicalwebteam/dotrun-image:latest .
You can install the package locally using either pip or poetry.
pip3 install . requests==2.31.0
pip install poetry
poetry install --no-interaction
To run dotrun off alternative base images such as local images, you can use the --image
flag.
dotrun --image "localimage" exec echo hello
To run dotrun off alternative releases, besides the :latest
release, you can use the --release
flag.
dotrun --release "latest" serve
Note that before changing the base image you should run
dotrun clean
to get rid of the old virtualenv.
FAQs
A tool for developing Node.js and Python projects
We found that dotrun demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.