14

I'm planning a service that will require allowing users to run arbitrary JVM code on a server. I'm planning to sandbox the code, but I know that the JVM has traditionally had security holes, which is why I want to explore other avenues.

There are already services such as Travis CI which allow anyone to run any code on their servers by checking it into GitHub.

How can a service like this ensure that someone isn't taking advantage of their servers to launch an attack or other malicious behavior?

  • 5
    They run builds in VMs which are rolled back to a standard snapshot after every build. – user1937198 Mar 17 '14 at 20:54
  • 1
    Right, I figured as much... but they could still be used for executing malicious code during a build. I would imagine that, in order to not be legally held liable for an attack, they'd have to have some measures in place. – Ryan Kennedy Mar 17 '14 at 21:05
  • 1
    Yes that's why I put it in a comment not an answer. I'd quite like to know how they handle that as well. – user1937198 Mar 17 '14 at 21:07
  • 2
    Do they? I mean, sure, they should, but... – JaimeCastells Oct 22 '15 at 2:40
  • 1
    I'm voting to close this question as off-topic because if it specific, OP should ask them directly or the question should be changed to be how one could do this without regard to how they do it. – Eric G Dec 28 '15 at 15:02
1

There are Docker containers for Java and I think some of the newer CI services might use those. You can put all sorts of additional restrictions on those, such as limiting memory/network/CPU/etc. VMs can also do this of course.

  • Are you suggesting that Docker adds security? If so, what does it protect and not protect? – Neil Smithline Jan 4 '16 at 21:07
  • Docker (or other containers) do bring some security, but offer a pretty large attack surface by themselves. I'd trust SELinux / traditional linux security rather than a container (or you can stack them: run each JVM inside a container, each container inside a SELinux/user sandbox). – ptyx Jan 4 '16 at 23:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.