Thank you for all the advice.
What would a “simple safe scripting language on Elixir” look like to you? Would this also use ports? Implemented in C?
bjfish
OvermindDL1
I’d personally would use either luerl or actual LUA through a PORT, depending on the feature-set I needed.
If I were to make a new scripting language, it would probably be SML-like, probably just implemented in elixir itself… ^.^
2
rvirding
Creator of Erlang
It is basically impossible to sandbox an erlang/elixir system if you allow it to run untested code, especially if you allow loading already compiled code. You *could* interpret erlang/elixir code but it would have to be very limiting but it is still possible to get around this. If you want to run the code within the erlang/elxixir system then the only safe way is to interpret/run another language where you can control how it interacts with the system outside it. Like for example running Lua either with luerl.
Another way would be to run a “safe” language/system outside erlang/elixir. Or perhaps best of all run a special system inside a DMZ.
15
OvermindDL1
Better than docker, but still not secure as it is possible to talk across kernel bounds, and it still has overhead compared to, say, Illumos’s Containers.
2
minhajuddin
Thanks for clarifying. I was always under the impression that using Docker provided secure isolation if the process inside the container was running with a non root user. There are many posts which talk about creating a standard non sudo user in the container and then running the container process with that user:
#!/bin/bash
# /opt/build/entry.sh
# create the user
useradd --home /opt/build --shell /bin/bash "statictrain"
# run our script with this new non-sudo user
su --command /opt/scripts/build.sh "statictrain"
docker run --rm .... /opt/build/entry.sh
Is this approach not secure?
I just created an account with Joyent (https://www.joyent.com/smartos) to play around with smartos containers (Had no idea they existed 
). They are giving a $250 credit for new accounts, so that is nice
1
DianaOlympos
No it is not secure. The simplest to explain escape is the following escape : escape the container limits and then the only “security” you have is the one provided… by the user system. And you are back to just normal linux kernel security in the whole box.
Even LXC is not that good, and i would not advise to use it before another couple years to clean a bit the code.
Docker is good at writing dockerfiles and as a build tool. It is not a really good production environment. In general Linux is not the best environment for containers right now.
About SmartOS : you can run your docker container here and it will be secure, due to using Zones. They use the Docker Remote API.
2
bjfish
I’m curious why the following approach may not work: suppose you forked elixir and removed any modules that might run or load untrusted code like File, eval, IO, compile, etc. Assuming you compiled code with only this compiler, might this be an effective way to sandbox?
0
bjfish
A popular article on hacker news today is another person looking to run multi-tenant code:
Unfortunately, from what I’ve seen, no technology ticks all the boxes for my use case. I’m still looking for an audited, lightweight, easy to use sandbox, geared for running multi-tenant code.
0
rvirding
Creator of Erlang
Unfortunately it is still possible, and quite easy in fact, to load a module into the system. Even if you were to remove the code module the basic BIFs are still there. You would need a very very controlled access to stop this. And I still wouldn’t trust it. 
1