Sandboxing C++, Rust, Python Code?

• wasmer

  131 17,829 9.9 Rust

  🚀 The leading Wasm Runtime supporting WASIX, WASI and Emscripten

  

For file access, you want to look into WASI (example for wasmer), the standard file I/O API for Web Assembly. Both wasmer and wasmtime support that.

• wasmtime

  172 14,461 10.0 Rust

  A fast and secure runtime for WebAssembly

  

Look into Web Assembly and wasmer or wasmtime.

• InfluxDB

  www.influxdata.com featured

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• nsjail

  6 2,785 7.9 C++

  A lightweight process isolation tool that utilizes Linux namespaces, cgroups, rlimits and seccomp-bpf syscall filters, leveraging the Kafel BPF language for enhanced security.

  

I am currently working on a code execution engine (also written in Rust) which uses nsjail for sandboxing and gnu time for measuring time and memory usage under the hood. You can run arbitrary code simply using a rest api and there is also a client library for Rust. It can already run C++, Rust and Python (and a few other languages) while allowing you to specify multiple source files, environment variables, command line arguments, standard input and resource limits (e.g. time, memory, maximum number of processes and whether network access is allowed or not). After running the program, the engine reports exit codes, outputs (stdout and stderr) and the amount of resources the program used.

• sandkasten

  1 23 9.3 Rust

  Run untrusted code in an isolated environment

The code is available on GitHub (https://github.com/Defelo/sandkasten) and there is also a link to a public test instance in the readme. Feel free to let me know if this is useful to you or if something is unclear. Any kind of feedback is appreciated!

Suggest a related project