I'd like to allow untrusted users to run arbitrary Node apps. If I use iptables to block everything except trusted servers, make each user's home folder only visible to them, and use runuser to start their server, is there any risk of them accessing each others' data?
Basically I'll just create a new user for the instance, copy the app into the home directory, chown/chmod it, and then do:
runuser -l their-user-name -c /usr/local/bin/node /users/their-user-name/server.js
I realize they can swamp the memory/cpu/io. And obviously they can chmod their own data open, but that aside... is there any security risk that I'm missing?
My plan is to use iptables to let each specific user open a server on a one specific port, which can only receive incoming connections from my nginx server. And then allow outgoing connections to a trusted database server.