5 ms·

How do web sites like http://cpp.sh/ http://cpp.sh/ run code? Wouldn't it be enough to forbid/intercept system calls somehow and set limits with systemd-run or

How do web sites like http://cpp.sh/ http://cpp.sh/ run code? Wouldn't it be enough to forbid/intercept system calls somehow and set limits with systemd-run or do you really need a VM?

Bayart 4y ago
There's a talk by Matt Godbolt about the way https://godbolt.org https://godbolt.org works : https://www.youtube.com/watch?v=kIoZDUd5DKw https://www.youtube.com/watch?v=kIoZDUd5DKw
petercooper 4y ago
There's the source code for such a site, if that would help: https://github.com/radian-software/riju https://github.com/radian-software/riju Docker + heavily restricted user + firewalls.. seems to get you much of the way there. I am aware that some work was done back in the pre-Docker day with Ruby's online sandbox to neuter Ruby's ability to make certain syscalls, but I imagine Docker, eBPF, or even using WebAssembly makes it a lot easier now.
jrockway 4y ago
Some options already listed in replies to this comment, but you might consider gVisor as well: https://gvisor.dev/ https://gvisor.dev/ gVisor is kind of Linux running in Linux. More insolation than containers; less overhead than VMs (but less isolation, of course).
- jmillikin 4y ago
  > less overhead than VMs Make sure to benchmark your workload first -- gVisor's I/O subsystem is a lot slower than the Linux kernel's, so a VM can be materially faster if you're doing a lot of filesystem operations or file I/O. One of the systems I built at a former employer supported both gVisor and Firecracker for isolation, and the gVisor version was 10-50x slower for a specific class of workload that did ~millions of stat() calls at startup.
  - jrockway 4y ago
    Yup, very good point. I think that something like gVisor should probably be your second choice after you've eliminated VMs for whatever reason.
  - deleted 4y ago
    [deleted]
jerf 4y ago
"It's complicated." One thing to bear in mind is that these sites use super-paranoid security because it has been proved time and time again that it is necessary. I wouldn't look at any particular solution for running arbitrary code from a user and assume that it's actually 100% correct. I think this can help remove some of the mystery of how they do it, which is that there is very likely some way in which they actually aren't doing it. Once you remove that idea from the possibility space, the ways it is done start making much more sense. (And the idea becomes much more scary.)
coffeeblack 4y ago
Would it be possible to compile the compiler to wasm and then use it in the browser to compile the user code to wasm in the browser and then run that?

How do web sites like http://cpp.sh/ http://cpp.sh/ run code? Wouldn't it be enough to forbid/intercept system calls somehow and set limits with systemd-run or do you really need a VM?

Bayart 4y ago

There's a talk by Matt Godbolt about the way https://godbolt.org https://godbolt.org works : https://www.youtube.com/watch?v=kIoZDUd5DKw https://www.youtube.com/watch?v=kIoZDUd5DKw

petercooper 4y ago

There's the source code for such a site, if that would help: https://github.com/radian-software/riju https://github.com/radian-software/riju Docker + heavily restricted user + firewalls.. seems to get you much of the way there. I am aware that some work was done back in the pre-Docker day with Ruby's online sandbox to neuter Ruby's ability to make certain syscalls, but I imagine Docker, eBPF, or even using WebAssembly makes it a lot easier now.

jrockway 4y ago

Some options already listed in replies to this comment, but you might consider gVisor as well: https://gvisor.dev/ https://gvisor.dev/ gVisor is kind of Linux running in Linux. More insolation than containers; less overhead than VMs (but less isolation, of course).

jmillikin 4y ago
> less overhead than VMs Make sure to benchmark your workload first -- gVisor's I/O subsystem is a lot slower than the Linux kernel's, so a VM can be materially faster if you're doing a lot of filesystem operations or file I/O. One of the systems I built at a former employer supported both gVisor and Firecracker for isolation, and the gVisor version was 10-50x slower for a specific class of workload that did ~millions of stat() calls at startup.
- jrockway 4y ago
  Yup, very good point. I think that something like gVisor should probably be your second choice after you've eliminated VMs for whatever reason.
- deleted 4y ago
  [deleted]

jerf 4y ago

"It's complicated." One thing to bear in mind is that these sites use super-paranoid security because it has been proved time and time again that it is necessary. I wouldn't look at any particular solution for running arbitrary code from a user and assume that it's actually 100% correct. I think this can help remove some of the mystery of how they do it, which is that there is very likely some way in which they actually aren't doing it. Once you remove that idea from the possibility space, the ways it is done start making much more sense. (And the idea becomes much more scary.)

coffeeblack 4y ago

Would it be possible to compile the compiler to wasm and then use it in the browser to compile the user code to wasm in the browser and then run that?