4 ms·
Well, it turns out you can't sandbox Python at the language level. So now each user's code is run (a) in a separate process (b) in a chroot jail (c) as user nob
by brandonhsiao 13y ago
Well, it turns out you can't sandbox Python at the language level. So now each user's code is run (a) in a separate process (b) in a chroot jail (c) as user nobody (d) with umask set to 0 (e) with a time limit of 300ms.
- krallin 13y agoI thought pypy had a sandboxed mode, did you get to experiment with it? if you did, what did you think?
- dbaupp 13y agoHave you experimented with using linux's cgroups for real security? (e.g. you can white/black-list specific syscalls, set time & memory limits etc, all at the kernel level) Example sandbox: https://github.com/thestinger/playpen https://github.com/thestinger/playpen
- jnbiche 13y agopypy has a fairly advanced sandbox, and as a side effect your code will probably run faster.