ia-sandbox | Infoarena sandbox for running user submitted code

ia-sandbox is a Rust library. ia-sandbox has no bugs, it has no vulnerabilities, it has a Permissive License and it has low support. You can download it from GitLab.

ia-sandbox is a command line utility allowing you to run untrusted code, such as the one submitted by users on websites like [Codeforces] [Topcoder] or the website it was designed for [Infoarena] with certain limits for time (both user time and wall time), memory and number of processes while also collecting runtime information and exit status. It uses modern linux tools and as such requires a relatively new kernel: * [cgroups v1] - a linux kernel feature for limiting, accounting and isolating resource usage of a collection of proceeses * cpuacct - for precise user time usage and limits, requires a 64-bit computer for proper precision. Requires linux kernel ≥ 2.6.24 * memory - for memory usage and limits. Requires linux kernel ≥ 2.6.24 * pids - for limiting the number of processes, necessary for protection against fork bombs. Requires linux kernel ≥ 4.3 * [linux namespaces] - another linux kernel feature for isolating resources on the system * mount - for isolating mountpoints, the isolated application will only see itself and whatever the caller desides to mount next to it. Requires linux kernel ≥ 2.4.19 * ipc - for ipc isolation. Requires linux kernel ≥ 2.6.19 * uts - for uts isolation. Requires linux kernel ≥ 2.6.19 * pid - for isolating processes, the sandboxed application will see itself as the only running process on the entire system. Requires linux kernel ≥ 2.6.24 * network - for isolating network interfaces, the application can not make any changes to network, or see external changes. Requires linux kernel ≥ 2.6.24 * user namespaces - for isolating the user id and group id. The isolated application will see itself as root inside the sandbox, and as having all capabilities but for the purpose of accessing resources it will actually be the user id of sandbox owner, greatly limiting whatever power or exploit the application can do. Requires linux kernel ≥ 3.5, but for proper security it is better for it to ≥ 3.9 * cgroup - for isolating cgroups, to not allow the sandboxed application to change its own limits or usage. Requires linux kernel ≥ 4.6. Since all of these features need to be active, the minimum required version is 4.6.