Integrated code lifecycle: Provide Instructors more options to control container configuration

src/main/java/de/tum/cit/aet/artemis/buildagent/dto/BuildConfig.java

@@ -15,7 +15,8 @@
 @JsonInclude(JsonInclude.Include.NON_EMPTY)
 public record BuildConfig(String buildScript, String dockerImage, String commitHashToBuild, String assignmentCommitHash, String testCommitHash, String branch,
         ProgrammingLanguage programmingLanguage, ProjectType projectType, boolean scaEnabled, boolean sequentialTestRunsEnabled, boolean testwiseCoverageEnabled,
-        List<String> resultPaths, int timeoutSeconds, String assignmentCheckoutPath, String testCheckoutPath, String solutionCheckoutPath) implements Serializable {
+        List<String> resultPaths, int timeoutSeconds, String assignmentCheckoutPath, String testCheckoutPath, String solutionCheckoutPath, DockerRunConfig dockerRunConfig)
+        implements Serializable {
 
     @Override
     public String dockerImage() {

src/main/java/de/tum/cit/aet/artemis/buildagent/dto/DockerRunConfig.java

@@ -0,0 +1,56 @@
+package de.tum.cit.aet.artemis.buildagent.dto;
+
+import java.io.Serializable;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+
+public class DockerRunConfig implements Serializable {
+
+    private boolean isNetworkDisabled;
+
+    private List<String> env;
+
+    public boolean isNetworkDisabled() {
+        return isNetworkDisabled;
+    }
+
+    public void setNetworkDisabled(boolean networkDisabled) {
+        isNetworkDisabled = networkDisabled;
+    }
+
+    public List<String> getEnv() {
+        return env;
+    }
+
+    public void setEnv(List<String> env) {
+        this.env = env;
+    }
+
+    public enum AllowedDockerFlags {
+
+        NETWORK("network"), ENV("env");
+
+        private final String flag;
+
+        AllowedDockerFlags(String flag) {
+            this.flag = flag;
+        }
+
+        public String flag() {
+            return flag;
+        }
+
+        private static final Set<String> ALLOWED_FLAGS = new HashSet<>();
+
+        static {
+            for (AllowedDockerFlags value : values()) {
+                ALLOWED_FLAGS.add(value.flag());
+            }
+        }
+
+        public static boolean isAllowed(String flag) {
+            return ALLOWED_FLAGS.contains(flag);
+        }
+    }
+}

src/main/java/de/tum/cit/aet/artemis/buildagent/service/BuildJobContainerService.java

@@ -45,7 +45,9 @@
 
 import de.tum.cit.aet.artemis.core.exception.LocalCIException;
 import de.tum.cit.aet.artemis.programming.domain.ProgrammingLanguage;
+import de.tum.cit.aet.artemis.programming.domain.ProjectType;
 import de.tum.cit.aet.artemis.programming.domain.build.BuildLogEntry;
+import de.tum.cit.aet.artemis.programming.service.ci.ContinuousIntegrationService.DependencyDownloadScript;
 import de.tum.cit.aet.artemis.programming.service.ci.ContinuousIntegrationService.RepositoryCheckoutPath;
 
 /**
@@ -85,19 +87,23 @@ public BuildJobContainerService(DockerClient dockerClient, HostConfig hostConfig
     /**
      * Configure a container with the Docker image, the container name, optional proxy config variables, and set the command that runs when the container starts.
      *
-     * @param containerName the name of the container to be created
-     * @param image         the Docker image to use for the container
-     * @param buildScript   the build script to be executed in the container
+     * @param containerName   the name of the container to be created
+     * @param image           the Docker image to use for the container
+     * @param buildScript     the build script to be executed in the container
+     * @param exerciseEnvVars the environment variables provided by the instructor
      * @return {@link CreateContainerResponse} that can be used to start the container
      */
-    public CreateContainerResponse configureContainer(String containerName, String image, String buildScript) {
+    public CreateContainerResponse configureContainer(String containerName, String image, String buildScript, List<String> exerciseEnvVars) {
         List<String> envVars = new ArrayList<>();
         if (useSystemProxy) {
             envVars.add("HTTP_PROXY=" + httpProxy);
             envVars.add("HTTPS_PROXY=" + httpsProxy);
             envVars.add("NO_PROXY=" + noProxy);
         }
         envVars.add("SCRIPT=" + buildScript);
+        if (exerciseEnvVars != null && !exerciseEnvVars.isEmpty()) {
+            envVars.addAll(exerciseEnvVars);
+        }
         return dockerClient.createContainerCmd(image).withName(containerName).withHostConfig(hostConfig).withEnv(envVars)
                 // Command to run when the container starts. This is the command that will be executed in the container's main process, which runs in the foreground and blocks the
                 // container from exiting until it finishes.
@@ -125,7 +131,19 @@ public void startContainer(String containerId) {
      * @param buildJobId  the id of the build job that is currently being executed
      */
 
-    public void runScriptInContainer(String containerId, String buildJobId) {
+    public void runScriptInContainer(String containerId, String buildJobId, boolean isNetworkDisabled) {
+        if (isNetworkDisabled) {
+            // The "sh preScript.sh" execution command specified here is need to install dependencies and prepare the environment for the build script.
+            log.info("Started running the pre-script for build job in container with id {}", containerId);
+            executeDockerCommand(containerId, buildJobId, true, true, false, "bash", LOCALCI_WORKING_DIRECTORY + "/preScript.sh");
+            try {
+                dockerClient.disconnectFromNetworkCmd().withContainerId(containerId).withNetworkId("bridge").exec();
+            }
+            catch (Exception e) {
+                log.error("Failed to disconnect container with id {} from network: {}", containerId, e.getMessage());
+            }
+        }
+
         log.info("Started running the build script for build job in container with id {}", containerId);
         // The "sh script.sh" execution command specified here is run inside the container as an additional process. This command runs in the background, independent of the
         // container's
@@ -285,7 +303,7 @@ public String getIDOfRunningContainer(String containerName) {
      */
     public void populateBuildJobContainer(String buildJobContainerId, Path assignmentRepositoryPath, Path testRepositoryPath, Path solutionRepositoryPath,
             Path[] auxiliaryRepositoriesPaths, String[] auxiliaryRepositoryCheckoutDirectories, ProgrammingLanguage programmingLanguage, String assignmentCheckoutPath,
-            String testCheckoutPath, String solutionCheckoutPath) {
+            String testCheckoutPath, String solutionCheckoutPath, ProjectType projectType, boolean isNetworkDisabled) {
 
         assignmentCheckoutPath = (!StringUtils.isBlank(assignmentCheckoutPath)) ? assignmentCheckoutPath
                 : RepositoryCheckoutPath.ASSIGNMENT.forProgrammingLanguage(programmingLanguage);
@@ -312,10 +330,17 @@ public void populateBuildJobContainer(String buildJobContainerId, Path assignmen
             addAndPrepareDirectory(buildJobContainerId, auxiliaryRepositoriesPaths[i], LOCALCI_WORKING_DIRECTORY + "/testing-dir/" + auxiliaryRepositoryCheckoutDirectories[i]);
         }
 
-        createScriptFile(buildJobContainerId);
+        createScriptFile(buildJobContainerId, isNetworkDisabled, programmingLanguage, projectType);
     }
 
-    private void createScriptFile(String buildJobContainerId) {
+    private void createScriptFile(String buildJobContainerId, boolean isNetworkDisabled, ProgrammingLanguage programmingLanguage, ProjectType projectType) {
+        if (isNetworkDisabled) {
+            String preScript = getDependencyDownloadScript(programmingLanguage, projectType);
+
+            executeDockerCommand(buildJobContainerId, null, false, false, true, "bash", "-c", "echo '" + preScript + "' > " + LOCALCI_WORKING_DIRECTORY + "/preScript.sh");
+            executeDockerCommand(buildJobContainerId, null, false, false, true, "bash", "-c", "chmod +x " + LOCALCI_WORKING_DIRECTORY + "/preScript.sh");
+        }
+
         executeDockerCommand(buildJobContainerId, null, false, false, true, "bash", "-c", "echo \"$SCRIPT\" > " + LOCALCI_WORKING_DIRECTORY + "/script.sh");
         executeDockerCommand(buildJobContainerId, null, false, false, true, "bash", "-c", "chmod +x " + LOCALCI_WORKING_DIRECTORY + "/script.sh");
     }
@@ -447,4 +472,17 @@ private String getParentFolderPath(String path) {
         Path parentPath = Paths.get(path).normalize().getParent();
         return parentPath != null ? parentPath.toString() : "";
     }
+
+    private String getDependencyDownloadScript(ProgrammingLanguage programmingLanguage, ProjectType projectType) {
+        return switch (programmingLanguage) {
+            case JAVA -> switch (projectType) {
+                case PLAIN_MAVEN, MAVEN_BLACKBOX, MAVEN_MAVEN -> DependencyDownloadScript.MAVEN.getScript();
+                case PLAIN_GRADLE, GRADLE_GRADLE -> DependencyDownloadScript.GRADLE.getScript();
+                default -> DependencyDownloadScript.OTHER.getScript();
+            };
+            case RUST -> DependencyDownloadScript.RUST.getScript();
+            case JAVASCRIPT -> DependencyDownloadScript.JAVASCRIPT.getScript();
+            default -> DependencyDownloadScript.OTHER.getScript();
+        };
+    }
 }

src/main/java/de/tum/cit/aet/artemis/buildagent/service/BuildJobExecutionService.java

@@ -192,10 +192,18 @@ public BuildResult runBuildJob(BuildJobQueueItem buildJob, String containerName)
             index++;
         }
 
-        CreateContainerResponse container = buildJobContainerService.configureContainer(containerName, buildJob.buildConfig().dockerImage(), buildJob.buildConfig().buildScript());
+        List<String> envVars = null;
+        boolean isNetworkDisabled = false;
+        if (buildJob.buildConfig().dockerRunConfig() != null) {
+            envVars = buildJob.buildConfig().dockerRunConfig().getEnv();
+            isNetworkDisabled = buildJob.buildConfig().dockerRunConfig().isNetworkDisabled();
+        }
+
+        CreateContainerResponse container = buildJobContainerService.configureContainer(containerName, buildJob.buildConfig().dockerImage(), buildJob.buildConfig().buildScript(),
+                envVars);
 
         return runScriptAndParseResults(buildJob, containerName, container.getId(), assignmentRepoUri, testsRepoUri, solutionRepoUri, auxiliaryRepositoriesUris,
-                assignmentRepositoryPath, testsRepositoryPath, solutionRepositoryPath, auxiliaryRepositoriesPaths, assignmentCommitHash, testCommitHash);
+                assignmentRepositoryPath, testsRepositoryPath, solutionRepositoryPath, auxiliaryRepositoriesPaths, assignmentCommitHash, testCommitHash, isNetworkDisabled);
     }
 
     /**
@@ -230,7 +238,7 @@ public BuildResult runBuildJob(BuildJobQueueItem buildJob, String containerName)
     private BuildResult runScriptAndParseResults(BuildJobQueueItem buildJob, String containerName, String containerId, VcsRepositoryUri assignmentRepositoryUri,
             VcsRepositoryUri testRepositoryUri, VcsRepositoryUri solutionRepositoryUri, VcsRepositoryUri[] auxiliaryRepositoriesUris, Path assignmentRepositoryPath,
             Path testsRepositoryPath, Path solutionRepositoryPath, Path[] auxiliaryRepositoriesPaths, @Nullable String assignmentRepoCommitHash,
-            @Nullable String testRepoCommitHash) {
+            @Nullable String testRepoCommitHash, boolean isNetworkDisabled) {
 
         long timeNanoStart = System.nanoTime();
 
@@ -246,13 +254,13 @@ private BuildResult runScriptAndParseResults(BuildJobQueueItem buildJob, String
         log.debug(msg);
         buildJobContainerService.populateBuildJobContainer(containerId, assignmentRepositoryPath, testsRepositoryPath, solutionRepositoryPath, auxiliaryRepositoriesPaths,
                 buildJob.repositoryInfo().auxiliaryRepositoryCheckoutDirectories(), buildJob.buildConfig().programmingLanguage(), buildJob.buildConfig().assignmentCheckoutPath(),
-                buildJob.buildConfig().testCheckoutPath(), buildJob.buildConfig().solutionCheckoutPath());
+                buildJob.buildConfig().testCheckoutPath(), buildJob.buildConfig().solutionCheckoutPath(), buildJob.buildConfig().projectType(), isNetworkDisabled);
 
         msg = "~~~~~~~~~~~~~~~~~~~~ Executing Build Script for Build job " + buildJob.id() + " ~~~~~~~~~~~~~~~~~~~~";
         buildLogsMap.appendBuildLogEntry(buildJob.id(), msg);
         log.debug(msg);
 
-        buildJobContainerService.runScriptInContainer(containerId, buildJob.id());
+        buildJobContainerService.runScriptInContainer(containerId, buildJob.id(), isNetworkDisabled);
 
         msg = "~~~~~~~~~~~~~~~~~~~~ Finished Executing Build Script for Build job " + buildJob.id() + " ~~~~~~~~~~~~~~~~~~~~";
         buildLogsMap.appendBuildLogEntry(buildJob.id(), msg);

src/main/java/de/tum/cit/aet/artemis/programming/domain/ProgrammingExercise.java

@@ -39,6 +39,7 @@
 import de.tum.cit.aet.artemis.assessment.domain.AssessmentType;
 import de.tum.cit.aet.artemis.assessment.domain.Result;
 import de.tum.cit.aet.artemis.assessment.domain.Visibility;
+import de.tum.cit.aet.artemis.buildagent.dto.DockerRunConfig;
 import de.tum.cit.aet.artemis.core.domain.Course;
 import de.tum.cit.aet.artemis.core.exception.BadRequestAlertException;
 import de.tum.cit.aet.artemis.exercise.domain.Exercise;
@@ -815,6 +816,21 @@ public void validateSettingsForFeedbackRequest() {
         }
     }
 
+    /**
+     * Validates the network access feature for the given programming language.
+     * Currently, SWIFT and HASKELL do not support disabling the network access feature.
+     *
+     */
+    public void validateBuildPlanNetworkAccessForProgrammingLanguage() {
+        if (List.of(ProgrammingLanguage.SWIFT, ProgrammingLanguage.HASKELL).contains(getProgrammingLanguage())) {
+            ProgrammingExerciseBuildConfig buildConfig = getBuildConfig();
+            DockerRunConfig dockerRunConfig = buildConfig.getDockerRunConfig();
+            if (dockerRunConfig != null && dockerRunConfig.isNetworkDisabled()) {
+                throw new BadRequestAlertException("This programming language does not support disabling the network access feature", "Exercise", "networkAccessNotSupported");
+            }
+        }
+    }
+
     public Set<ExerciseHint> getExerciseHints() {
         return exerciseHints;
     }

src/main/java/de/tum/cit/aet/artemis/programming/domain/ProgrammingExerciseBuildConfig.java

@@ -1,7 +1,11 @@
 package de.tum.cit.aet.artemis.programming.domain;
 
+import java.util.ArrayList;
+import java.util.List;
 import java.util.Objects;
 import java.util.UUID;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
 
 import jakarta.annotation.Nullable;
 import jakarta.persistence.Column;
@@ -10,14 +14,18 @@
 import jakarta.persistence.Table;
 import jakarta.validation.constraints.Size;
 
+import org.apache.commons.lang3.StringUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.core.type.TypeReference;
+import com.fasterxml.jackson.databind.ObjectMapper;
 
+import de.tum.cit.aet.artemis.buildagent.dto.DockerRunConfig;
 import de.tum.cit.aet.artemis.core.domain.DomainObject;
 import de.tum.cit.aet.artemis.programming.service.aeolus.Windfile;
 import de.tum.cit.aet.artemis.programming.service.vcs.AbstractVersionControlService;
@@ -292,6 +300,81 @@
         this.solutionCheckoutPath = solutionCheckoutPath;
     }
 
+    /**
+     * Converts a JSON string representing Docker flags (in the form of a list of key-value pairs)
+     * into a {@link DockerRunConfig} instance.
+     *
+     * <p>
+     * The JSON string is expected to represent a list of key-value pairs where each
+     * entry is a list containing two strings: the first being the key and the second being the value.
+     * Example JSON input:
+     *
+     * <pre>
+     * [["network", "none"], ["env", "TEST"]]
+     * </pre>
+     *
+     * @return a {@link DockerRunConfig} object initialized with the parsed flags, or {@code null} if an error occurs
+     */
+    public DockerRunConfig getDockerRunConfig() {
+        if (StringUtils.isBlank(dockerFlags)) {
+            return null;
+        }
+
+        try {
+            ObjectMapper objectMapper = new ObjectMapper();
+
+            List<List<String>> list = objectMapper.readValue(dockerFlags, new TypeReference<>() {
+            });
+
+            DockerRunConfig dockerRunConfig = new DockerRunConfig();
+            for (List<String> entry : list) {
+                if (entry.size() != 2 || entry.get(0) == null || entry.get(1) == null || entry.get(0).isBlank() || entry.get(1).isBlank()
+                        || !DockerRunConfig.AllowedDockerFlags.isAllowed(entry.get(0))) {
+                    log.warn("Invalid Docker flag entry: {}. Skipping.", entry);
+                    continue;
+                }
+                switch (entry.get(0)) {
+                    case "network":
+                        dockerRunConfig.setNetworkDisabled(entry.get(1).equalsIgnoreCase("none"));
+                        break;
+                    case "env":
+                        dockerRunConfig.setEnv(parseEnvVariableString(entry.get(1)));
+                        break;
+                    default:
+                        log.error("Invalid Docker flag entry: {}. Skipping.", entry);
+                        break;
+                }
+
+            }
+            return dockerRunConfig;
+        }
+        catch (Exception e) {
+            log.error("Failed to parse DockerRunConfig from JSON string: {}. Using default settings.", dockerFlags, e);
+        }
+
+        return null;
+    }
+
+    private List<String> parseEnvVariableString(String envVariableString) {
+        Pattern pattern = Pattern.compile(
+                // match key-value pairs, where the key can be a single word or a string in single or double quotes
+                // key-value pairs are separated by commas
+                "(?:'([^']+)'|\"([^\"]+)\"|(\\w+))=(?:'([^']*)'|\"([^\"]*)\"|([^,]+))");
+
+        Matcher matcher = pattern.matcher(envVariableString);
+
+        List<String> envVars = new ArrayList<>();
+        while (matcher.find()) {
+            String key = matcher.group(1) != null ? matcher.group(1) : matcher.group(2) != null ? matcher.group(2) : matcher.group(3);
+
+            String value = matcher.group(4) != null ? matcher.group(4) : matcher.group(5) != null ? matcher.group(5) : matcher.group(6);
+
+            envVars.add(key + "=" + value);
+        }
+
+        return envVars;
+    }
+
     @Override
     public String toString() {
         return "BuildJobConfig{" + "id=" + getId() + ", sequentialTestRuns=" + sequentialTestRuns + ", branch='" + branch + '\'' + ", buildPlanConfiguration='"

src/main/java/de/tum/cit/aet/artemis/programming/service/ProgrammingExerciseService.java

@@ -364,6 +364,7 @@ public void validateNewProgrammingExerciseSettings(ProgrammingExercise programmi
         programmingExercise.validateProgrammingSettings();
         programmingExercise.validateSettingsForFeedbackRequest();
         validateCustomCheckoutPaths(programmingExercise);
+        programmingExercise.validateBuildPlanNetworkAccessForProgrammingLanguage();
         auxiliaryRepositoryService.validateAndAddAuxiliaryRepositoriesOfProgrammingExercise(programmingExercise, programmingExercise.getAuxiliaryRepositories());
         submissionPolicyService.validateSubmissionPolicyCreation(programmingExercise);