My college has a website which allows students to submit coding assignments by running them on an Online IDE which checks the output against several test cases.
I noticed by running system(“whoami”) that the code is running as root.
When I spoke to the developers, they said that its running on some EC2.
Every time a student runs the code, a docker container is assigned, which further executes the code.
What could be the possible attacks one could perform on such a system?
Does using a docker container justify giving root privileges?