apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    retoolService: code-executor
  name: code-executor
spec:
  replicas: 1
  selector:
    matchLabels:
      retoolService: code-executor
  revisionHistoryLimit: 3
  template:
    metadata:
      labels:
        retoolService: code-executor
    spec:
      containers:
        - args:
            - bash
            - start.sh
          env:
            - name: DEPLOYMENT_TEMPLATE_TYPE
              value: k8s-manifests
            - name: NODE_ENV
              value: production
            - name: NODE_OPTIONS
              value: --max_old_space_size=1024
            - name: PORT
              value: "3004"
          image: tryretool/code-executor-service:X.Y.Z
          name: code-executor
          ports:
            - containerPort: 3004
              name: retool
              protocol: TCP
          resources:
            limits:
              cpu: 2
              memory: 4Gi
            requests:
              cpu: 1
              memory: 1Gi
          # code executor uses nsjail to sandbox code execution. nsjail requires privileged container access.
          # If your deployment does not support privileged access, you can set this to false to not use nsjail.
          # Without nsjail, all code is run without sandboxing within your deployment.
          securityContext:
            privileged: true
---
apiVersion: v1
kind: Service
metadata:
  name: code-executor
spec:
  selector:
    retoolService: code-executor
  ports:
  - protocol: TCP
    port: 80
    targetPort: 3004
    name: http-server