Some services such as Github allows the execution of user supplied code using docker containers via Github Actions. Another example of a service provider that executes user provided code are continuous integration services such as Travis or AppVeyor.
This question does not consider the user's code breaking out of its VM or container, but rather code that can use up resources or launch attack on other systems via the internet.
Some examples of malicious behavior I'd like to define for this question are:
- Using your resources to mine cryptocurrency (for example using multiple travis jobs in a build matrix to mine cryptocurrency).
- Sending spam.
- Launch DDOS attacks on some host.
- Testing username/password combinations or credit card numbers against a service.
Since the code is user-define, it is pretty much impossible to do any sort of whitelisting or blacklisting. Blocking access to certain hosts on the internet would also be ineffective as the malicious user can host the malicious binaries anywhere and download them into the container or VM during execution.
How do services such as Github (via Github Action) and Travis prevent malicious behavior on their systems when executing user provided code?