Why an app build needs limits too
Understand why install scripts and Docker builds must be isolated, timed and limited before code reaches a pod.
App Cities · 2 min · Updated
A build runs code before your app goes online. Installing a package can run a script. A Dockerfile can download and start a program. That means a build needs safety limits too. Checking only the finished app leaves part of the process unprotected.
The steps
- Use dependencies you trust and keep a lockfile. Review new install scripts rather than treating every package as safe.
- Keep builds away from the platform's control systems and other customers. A project must not receive the host's admin keys or Docker socket.
- Set limits for time, CPU, RAM, disk and network use. A timeout must also stop work that continues in a child process.
- After an error or cancellation, verify cleanup. These checks need real tests; finding known miner names is not enough.
A common question
Is mining allowed during a build?
No. Moving mining into an install script does not make it acceptable. The platform's abuse rules apply to builds as well as running apps.
Ready to try your project?
Prepare your project, check the prices and choose how you want to deploy.