Add example for running Codapi in a Lima instance #41

Activity

1. afbjorklund

   changed the title [-]Add example for running Coda in a Lima instance[/-] [+]Add example for running Codapi in a Lima instance[/+] on Apr 18, 2026
2. afbjorklund commented on Apr 19, 2026

   

   afbjorklund

   on Apr 19, 2026

   Last edited by afbjorklund

   ContributorAuthor

   More actions

   The lima.yaml has been added, question is if it needs more docs?

   limactl start --cpus 2 --memory 2 https://raw.githubusercontent.com/nalgeon/codapi/refs/heads/main/docs/lima/codapi.yaml

   Like comparing pros and cons between running in containers/VMs.

   Or if it needs an expanded version, with running a web server too?

   ---

   Container (with nerdctl)

   • Running rootless containers, possibly in a shared VM
   • Sharing cpu and memory with other applications

   VM (as implemented here)

   • Running rootful containers, in a separate debian VM
   • Dedicated cpu and memory for the codapi instance

   Both solutions have a "codapi" user, with a separate home directory.
   And each sandbox runs as a "sandbox" user, in a separate namespace.

   The difference is if there are other users on the same machine - or not.
   The rootful docker has full access to it, but the home directory is "empty".

   https://docs.docker.com/engine/security/#docker-daemon-attack-surface

   ---

   The motivation for making a dedicated Lima instance was based on the:

   Make sure you install Codapi on a separate machine — this is a must for security reasons. Do not store any sensitive data or credentials on this machine. This way, even if someone runs malicious code that somehow escapes the isolated environment, they won't have access to your other machines and data.

   The default instance is sharing the home directory, just like a Linux host

   https://lima-vm.io/docs/usage/#home-directory
3. nalgeon commented on Apr 19, 2026

   

   nalgeon

   on Apr 19, 2026

   Owner

   More actions

   question is if it needs more docs?

   I don't know :) Sadly, I don't have the capacity to test or document this setup.
4. afbjorklund commented on Apr 19, 2026

   

   afbjorklund

   on Apr 19, 2026

   Last edited by afbjorklund

   ContributorAuthor

   More actions

   I will try to find some volunteers, to see if the docs "work" or not

   Maybe I should also have mentioned how to access codapi "admin"?

   It is (rather) straight-forward, and not very different to other setups.

   anders@ubuntu:~$ limactl shell codapi 
   anders@lima-codapi:~$ pwd
   /home/anders.guest
   anders@lima-codapi:~$ sudo su - codapi
   codapi@lima-codapi:~$ pwd
   /opt/codapi

   Will make a PR, also found an issue with the permission on sandboxes:

   codapi@lima-codapi:~$ ./codapi-cli sandbox add lua
   Downloading from https://github.com/nalgeon/sandboxes/releases/download/latest/lua.tar.gz...
   ##O#- #                                                                         Warning: Failed to open the file sandboxes/lua.tar.gz: Permission denied
   curl: (23) client returned ERROR on write of 689 bytes
   
   ERROR: Failed to download sandbox archive from https://github.com/nalgeon/sandboxes/releases/download/latest/lua.tar.gz
   

   -rw-r--r-- 1 codapi codapi   11365 Apr 18 06:39 LICENSE
   -rwxr-xr-x 1 codapi codapi 7381176 Apr 18 06:40 codapi
   -rwxr-xr-x 1 codapi codapi    7381 Apr 18 06:39 codapi-cli
   -rw-r--r-- 1 codapi codapi     422 Apr 18 06:39 codapi.json
   -rw-r--r-- 1 root   root       314 Apr 19 09:31 codapi.log
   drwxr-xr-x 3 root   root      4096 Apr 19 09:31 sandboxes
   

   Pretty sure that it was in codapi.tar.gz, so missing something here...

   anders@lima-codapi:~$ sudo chown codapi /opt/codapi/sandboxes

   The default user has sudo on the debian box, so easy to work around.
5. afbjorklund commented on Apr 19, 2026

   

   afbjorklund

   on Apr 19, 2026

   Last edited by afbjorklund

   ContributorAuthor

   More actions

   Eventually (with some debugging logging) I remembered:

   + sudo su - codapi
   + whoami
   root
   + cd /opt/codapi
   ++ curl -fsSL https://api.github.com/repos/nalgeon/codapi/releases/latest
   ++ jq -r .tag_name
   ++ sed -e s/v//
   + version=0.14.0
   + case $(uname -m) in
   ++ uname -m
   + arch=amd64
   + curl -fL -o codapi.tar.gz https://github.com/nalgeon/codapi/releases/download/v0.14.0/codapi_0.14.0_linux_amd64.tar.gz
     % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                    Dload  Upload   Total   Spent    Left  Speed
     0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
   100 3049k  100 3049k    0     0  2131k      0  0:00:01  0:00:01 --:--:-- 3022k
   + tar xvzf codapi.tar.gz
   LICENSE
   codapi-cli
   codapi.json
   codapi.service
   sandboxes/ash/Dockerfile
   sandboxes/ash/box.json
   sandboxes/ash/commands.json
   codapi
   + ls -l
   total 10296
   -rw-r--r-- 1 codapi codapi   11365 Apr 18 06:39 LICENSE
   -rwxr-xr-x 1 codapi codapi 7381176 Apr 18 06:40 codapi
   -rwxr-xr-x 1 codapi codapi    7381 Apr 18 06:39 codapi-cli
   -rw-r--r-- 1 codapi codapi     422 Apr 18 06:39 codapi.json
   -rw-r--r-- 1 codapi codapi     304 Apr 18 06:39 codapi.service
   -rw-r--r-- 1 root   root   3122415 Apr 19 13:01 codapi.tar.gz
   drwxr-xr-x 3 root   root      4096 Apr 19 13:01 sandboxes
   + rm -f codapi.tar.gz
   

   When you run su from a script, it does NOT start a new shell...

   • fix: remove sudo from lima provision #42
6. nalgeon

   closed this as completedin #43on Apr 20, 2026