How to create a sandbox to run untrusted code/modules?

[OvermindDL1]

@bjfish

Do you know of any strategies/papers/examples on how to prevent untrusted code to hog memory resources?

The best I’ve seen so far is just limiting the amount of memory that could be allocated but I was wondering if a better strategy is out there.

You could run it in a process and have the sandboxed code test it’s memory usage on each reduction or so, if it exceeds a value then GC it, if still exceeded then kill it? I’m doing that currently.