Docker Sandboxes for Untrusted Code

The problem

If your product executes user-submitted code, the default threat model is “they own the machine.” Sandboxing is not optional.

Isolation layers

On BugRank, a submission roughly:

1. Writes sources into a unique working directory (UUID)
2. Compiles/runs as an unprivileged executor user
3. Enforces wall-clock time (~5s) and memory (~256 MB)
4. Collects stdout/stderr and never promotes the process

Failure modes

• Infinite loops → hard kill on timeout
• Memory spikes → cgroup / memory limits
• Network exfiltration → deny egress for the runner when you can
• Shared state → never reuse dirty workspaces

The best security feature of a code-runner is what it refuses to share with the host.

Read on Medium