2 ms·
This is pretty neat. How do they create the playground systems on demand I wonder?
by CameronNemo 3y ago
This is pretty neat. How do they create the playground systems on demand I wonder?
- bravetraveler 3y agoThe about page briefly mentions Podman containers
- smashed 3y agoVery neat indeed. It says on the about page that it starts a container on demand and gives you the output. You can see in the output that systemd detects it is running under podman. No idea what kind of container as a service they are using, and how they secure/lock it down. Systemd is a pretty powerful system, you can make it execute pretty much anything...
- yonatan8070 3y agoThe bit where you edit the unit files is essentially built-in RCE
- CameronNemo 3y agoPresumably there are limits in place via podman (cgroups)... I didn't test them but did feel the urge to do so. I also didn't test network access, which could cause arbitrary code execution.