Dockerfile builder

Faber runs whatever toolchains its image contains. Tick the languages you serve and copy the result: a Dockerfile on top of vgfractal/faber:base (Faber without compilers) that installs only those toolchains, adds the paths they need to SANDBOX_READONLY_PATHS, and records them in FABER_TOOLCHAINS so GET /info can report them. The page keeps your choice in its URL, so you can share or bookmark it.

1. Languages

Compiled languages

C 12 GCC 12 with the GNU C library headers and GNU Make, from Debian bookworm. ≈ 183 MB 256M native_v2 C++ 12 G++ 12 (C++20 and most of C++23) with libstdc++ and GNU Make, from Debian bookworm. ≈ 239 MB 256M native_v2 Rust 1.99 The stable Rust compiler and Cargo from the official rust:slim-bookworm image, linking with GCC. ≈ 804 MB 512M native_v2 Go 1.27 The Go toolchain from the official golang:bookworm image, with a read-only build cache of the standard packages programs usually import, so a build does not compile them again. Builds static binaries (cgo off). ≈ 290 MB 512M compile_v2 Zig 0.17 The Zig compiler from the official ziglang.org release tarball (checksum verified). ≈ 373 MB 768M native_v2 Swift 6.4 The Swift compiler for Debian 12 from swift.org (checksum verified), with Foundation; without the package manager, debugger, editor tooling, static libraries and Embedded Swift. ≈ 1590 MB 512M native_v2

JVM

Java 25 Eclipse Temurin JDK 25 (LTS) from the official eclipse-temurin image. ≈ 263 MB 256M compile_v2 Kotlin 2.4 The Kotlin/JVM command-line compiler from the official JetBrains release (checksum verified). Runs on the Java toolchain. ≈ 97 MB 1G compile_v2

.NET

C# 10.0 The .NET 10 SDK (LTS) from the official Microsoft image. Builds projects offline; NuGet packages need network access, which tasks do not have. ≈ 640 MB 768M compile_v2

JavaScript and TypeScript

Node.js 24 Node.js 24 (LTS) with npm, from the official node:bookworm-slim image. ≈ 139 MB 256M compile_v2 TypeScript 6.0 The TypeScript 6 compiler with Node.js type definitions; compiled programs run on Node.js. (TypeScript 7's native compiler calls fanotify_init, which the sandbox refuses.) ≈ 27 MB 768M compile_v2 Bun 1.4 The Bun JavaScript and TypeScript runtime from the official oven/bun Debian image. ≈ 88 MB 256M compile_v2 Deno 2.9 The Deno JavaScript and TypeScript runtime from the official denoland/deno binary image. ≈ 95 MB 256M compile_v2

Scripting languages

Python 3.15 CPython 3.15 from the official python:slim-bookworm image, standard library precompiled. ≈ 57 MB 256M compile_v2 Ruby 4.0 Ruby 4.0 from the official ruby:slim-bookworm image. ≈ 88 MB 256M compile_v2 PHP 8.5 The PHP 8.5 CLI with OPcache, from the official php:cli-bookworm image. ≈ 76 MB 256M native_v2 Perl 5.36 Perl 5.36 with its core modules, from Debian bookworm. ≈ 56 MB 256M native_v2 Lua 5.4 The Lua 5.4 interpreter from Debian bookworm. ≈ 1 MB 256M native_v2

Functional languages

Haskell 9.14 The Glasgow Haskell Compiler from the official haskell:slim-bookworm image, without profiling libraries. ≈ 1799 MB 768M compile_v2

2. Options

Base image tag vgfractal/faber: base has Faber and no compilers. Pin a release tag in production. Extra Debian packages Separated by spaces or commas. Installed with apt-get. Image name Used in the build and run commands.

Dockerfile

Copy Download

# Faber with C 12.
# Generated from docker/toolchains/catalog.json by the Faber Dockerfile builder.

FROM vgfractal/faber:base

RUN apt-get update \
    && apt-get install -y --no-install-recommends \
        gcc \
        libc6-dev \
        make \
    && rm -rf /var/lib/apt/lists/*

ENV SANDBOX_READONLY_PATHS=/bin,/lib,/lib64,/usr,/etc/alternatives,/etc/ld.so.cache,/etc/passwd,/etc/group \
    FABER_TOOLCHAINS=c@12

# Identifies this build in the step cache. Pass a new value on every build:
#   docker build --build-arg FABER_IMAGE_ID="$(date -u +%Y%m%dT%H%M%SZ)" .
ARG FABER_IMAGE_ID=
ENV FABER_IMAGE_ID=${FABER_IMAGE_ID}

Build and run

Copy

Recommended limits

Language	Size	Memory	PIDs	Compile	Run	Task env

Before you deploy the image

1. Build it with the command above, in a directory that holds only the Dockerfile.
2. Test every language under the default sandbox profile before relying on it. Start the image (privileged, as above) and run API_URL=http://localhost:3000/api/v1 API_KEY=... scripts/toolchain-test.sh from a checkout of the repository; it runs each language’s example program and checks its output. On a development machine, run it inside the disposable VM with scripts/vm.sh test-toolchains instead.
3. Set FABER_IMAGE_ID to the image digest or your build ID when the step cache is enabled, so a rebuilt image never replays layers produced by different toolchains.
4. Pin the base tag to a release in production instead of base, which moves with every push to main.

Using the languages

• Profiles. The table lists the profile to compile with and the one to run with. Languages whose programs start threads (Go, the JVM, Node.js) run under compile_v2; single-threaded native programs can run under the stricter native_v2. See sandbox profiles.
• Task environment. Tasks do not inherit the image’s ENV. Some toolchains need a writable home or cache directory; send the variables in the “Task env” column in each task’s env.
• Limits. MEMORY_MAX and PIDS_MAX apply to every task of an instance. If one language needs more, every task gets more, and the instance needs more memory per task slot. Serving a heavy runtime and many light ones? Consider separate instances.

A language that is not listed

Write the Dockerfile by hand on top of the builder’s output: install the toolchain under a path tasks can see, link its commands into /usr/local/bin (the sandbox’s PATH does not include the image’s), add any other path it reads to SANDBOX_READONLY_PATHS, and test it as above. Docker deployment lists the rules.