bjfish
How to create a sandbox to run untrusted code/modules?
I would like to create a server that allows other users to run white-listed functions. It would be nice if the untrusted code were packaged as hex packages.
The use case is to allow users to run plugins to a framework in a shared server environment.
I’ve seen some existing implementations/experiments of this in Elixir.
What would be the most thorough approach be to run untrusted Elixir code?
Some previous threads/code I’ve found:
Trending in Questions
Other Trending Topics
Latest on Elixir Forum
Sponsor Spotlight
Supporting innovation across the BEAM ecosystem.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #channels
- #elixirconf
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixir-ls
- #phoenix_html
- #iex
- #blog-post
- #graphql
- #genstage
- #ai
- #elixirconf-us
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #metaprogramming
- #performance
- #security
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Practical resources that improve the lives of professional developers.
Bringing learning, work and compliance together since 1987.
Enabling companies to succeed by building software people love.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
First Post!
OvermindDL1
Why not let them run an embedded language, like LUA?
Most Liked
rvirding
It is basically impossible to sandbox an erlang/elixir system if you allow it to run untested code, especially if you allow loading already compiled code. You *could* interpret erlang/elixir code but it would have to be very limiting but it is still possible to get around this. If you want to run the code within the erlang/elxixir system then the only safe way is to interpret/run another language where you can control how it interacts with the system outside it. Like for example running Lua either with luerl.
Another way would be to run a “safe” language/system outside erlang/elixir. Or perhaps best of all run a special system inside a DMZ.
OvermindDL1
Exactly this! Docker is NOT a sandbox, it is pretty trivial to ‘break out of it’, and it is designed for process segmentation, not sandboxing, and the developers are upfront about that. Anyone using docker to sandbox has a ticking time-bomb…
SmartOS Zones would be a good sandbox though. FreeBSD Jails, they ‘mostly’ work, but they can be broken out of with relative ease now too. I’d still say just support lua or something, not elixir.
DianaOlympos
I know i am a Cassandra at that point and that i mess a bit with the whole fun thing.
But Docker is not a sandbox. Is it better than the BEAM isolation ? Yes probably. But if you need a secure sandbox with Docker, the advise right now and for the year to come probably is to have one VM per Docker container. If you want a more secure sandbox/container, have a look at FreeBSD Jails or SmartOS Zones. You can run a Docker container on SmartOS Zones.
Last Post!
rvirding
But then in one sense you are not really running untrusted code. The trouble with code is that it can do anything it wants to, it’s pretty much like having root privileges on a machine. The only way is to interpret the code in some way to check what it is doing. For example even it was running in a process with max memory set there is nothing stopping from starting another process and do what it want there.
This was a problem we did not attack.