How to allow users to execute code on my SaaS product server-side?
6 comments
I’d look into a few things like https://firecracker-microvm.github.io/
I ran a little app that required arbitrary latex execution and I think a similar set up would apply:
1. Run code in docker container.
2. Within container run code as unprivileged user.
3. SELinux harden container.
4. Don’t run container as admin if you don’t have to.
5 Specify CPU and memory allowance per container. Run container for make T time.
6. Use a queue to govern how containers are spun up.
7. Don’t reuse containers.
8. Dependent on language, configure compiler/interpreter to disallow risky features.
1. Run code in docker container.
2. Within container run code as unprivileged user.
3. SELinux harden container.
4. Don’t run container as admin if you don’t have to.
5 Specify CPU and memory allowance per container. Run container for make T time.
6. Use a queue to govern how containers are spun up.
7. Don’t reuse containers.
8. Dependent on language, configure compiler/interpreter to disallow risky features.
Firstly, why do you need your users to write and run arbitary code on your servers? If your product is such that user access is needed, then publishing an API for access would appear to be a simpler approach.
Nevertheless, if you do need to do so, why not look into using FreeBSD with jails, etc? Alternatively you could spin-up a hosted VM on their behalf and have them use that. But anybody who can program could probably do that for themselves, thus my API suggestion as above.
Nevertheless, if you do need to do so, why not look into using FreeBSD with jails, etc? Alternatively you could spin-up a hosted VM on their behalf and have them use that. But anybody who can program could probably do that for themselves, thus my API suggestion as above.
One option that was just announced is https://news.ycombinator.com/item?id=32240511
My employer, wasmer.io is doing exactly that. You can contact the CEO directly to discuss how it can solve your problems.
have you checked about firecracker vm?
What would be the best approach as far as containerizing + sandboxing the execution runtime, such that they can execute code from various languages like Python, Node.js, etc. without something "escaping" into our EC2 instances for instance (pun intended)
Obviously, this has been done (many times) before, so I'm curious if any of you have experience with this sort of thing and the best implementation. Are there any libraries, frameworks, etc. out there already for something like this?