Securely compile foreign code and run it on a server?

Question

I would like to set up a server that can receive source code directly, compile/interpret it and execute it.

The code could be C#, Java, C++, C, Javascript, PHP...

There will obviously be security concerns, I would like to know if you have any recommendations to prevent the server from being compromised?

From what I look on the internet, Docker seems to be a good solution. Is that correct?

I would like each code to be independent, so if malicious code destroys it's own virtual machine, it does not matter.

To explain more in detail, I think of a game of programming, the players will write their codes, locally on their machine and send them in an arena to compete for example in 1 vs 1 with, in between, the engine Game.

The idea would be to have 3 programs, for a game in 1 against 1 (2 players and the arena) the information exchanged between each of the programs would be characters strings I would also like to the player program to be compiled on a server (in the vm docker for example).

I would like the code to run on the server side so that each player has the same computing power.

Answer 1

What you're looking to do, if I read your question correctly, is to isolate possibly hostile code to be compiled and run on a server you control.

So you need some kind of sandbox/isolation to do that.

The question you need to think about is "how much isolation do I need"

Docker will provide reasonable isolation but it still exposes the Linux kernel on the host (all containers, by default, share the same Linux kernel) so an attacker could try and exploit an issue there. Also attacker code could do things like scan the local network to try and find other things to attack.

Some possible options to improve the isolation provided by base Docker.

1) Drop capabilities from the running containers using the --cap-drop=ALL option. This reduces the privileges that the container has and makes it harder to break out

2) If the running container doesn't need network access use --network=none so it can't attempt to make connections out to other machines.

3) Don't run the containers as root, make sure you set a specific user for each container.

You could also isolate each task inside a different Virtual machine, although there's a resource hit over Docker for that.

Answer 2

One of the main concerns I can see is cross site-scripting or injection attacks. Need to check all input is escaped and checked for formatting before sending it across to the server. Essentially you will have to limit the type of program that each user can write because they could insert malicious code.

Also I would recommend looking into the secure socket layer (SSL) protocol to exchange data from client to server.

If you are using docker there are additional concerns, such as access to containers and to the docker client.

Finally, you would also need to secure your server before you can host it.