I'm writting a online judge(support C/C++、GoLang). I want to implement a sandbox by myself. my idea:
namespace and cgroups
- compile user's source code statically
- run executable file in a complete new namespace (
- use PivotRoot to set a new root(nothing in root except executable file)
- use cgroups to control resource(memory/cpu/pid)
- set timeout(use
- because resource limit and complete new namespace, I will not filter any system call
- use seccomp to filter bad system call
- set timeout and limit memory
the online judge is write for my school. there are not sensitive data on where my sandbox running.
which one is better or safer? or any other good idea?