I'm creating a server that is in charge of building code. This server should be able to run arbitrary building scripts without those being able to harm the server. For example by modifying configuration files, tampering binaries or stealing secrets in home.

Do you have any tips for this?

  • 2
    Use a building container. Or a virtual machine.
    – ThoriumBR
    May 19, 2020 at 23:27
  • Could you clarify in your question what level of assurance you want? Might the build scripts be malicious (if the attacker managed to get inside, would this be a way they could try to take over servers?) or is it more of an integrity thing (so that the build server keeps running if the developers make a mistake)?
    – Luc
    May 20, 2020 at 20:21
  • With malicious building scripts. May 21, 2020 at 17:22

2 Answers 2


This isn’t a simple answer. There are tools specific to different operating systems like Windows or Linux that perform file integrity monitoring. Be aware that things like system or build tool updates can create a lot of false positives.

There are some things you can do around checking code but that will generally add a lot of management overhead. Are these scripts coming from untrusted sources or do you want to double check that internal developers aren’t doing anything bad?

One of the easiest things to do is network segmentation. Make sure the box is isolated in an environment where it can build properly but connections originating from this box can’t connect to other systems. This will help even if someone does manage to sneak something malicious in there is isn't a path for it to get out compromise other machines.

  • I want the system itself to prevent malicious code from doing something malicious. May 21, 2020 at 17:32

You should checkout gVisor, you can use it to isolate containers running these builds from the host machine, if you're planning on using containers. I believe GCP uses gVisor in some capacity. Either way you should be able to run potentially malicious code without it affecting the host machine.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .