I am building a system which has the functions of an online judge system. I need to run all the executables and evaluate their output. The problem is that if all of them will be placed in a container, in different folders one of the application may try to exit it's folder and access another folder belonging to another application. In this case the main server will be protected, but not the other applications and not the evaluator.I have found myself a solution, but I am thinking there is a better one, I will create for example 5 containers, each one of them will be runing the same algorithm and each one of them will evaluate 1 problem at a time. After the problem is evaluated this one will be deleted and another one received. In this case, the main server and all the applications will be protected, but not the evaluator. The evaluated application may exit it's folder and start writing random text files for example, filling the entire memory.The evaluator will start the executable, measure it's time (if it is longer than 1 or 2 seconds it will kill it) and it's used memory(if it reaches a certain limit it will kill it).I have also thought to create a container each time and delete it after the executable is evaluated, but it takes a few seconds only to create and start the container...How do I isolate the evaluated process from messing with the container and evaluator? I basically want to block a process from accessing other folders.
Linux - Isolate process without containers
linux;container
I have not read anything in the description of your problem that would prevent you from creating different user accounts for the applications. You can then use trivial file permissions for preventing interference:chown app1 /var/lib/myapps/app1chmod 700 /var/lib/myapps/app1sudo -u app1 /var/lib/myapps/app1/run.sheditIf the evaluator is running as root then it can simply start the applications via sudo.If the evaluator does not run as root then the applications it calls (in the normal way) can be installed with the SUID bit (set user ID) so that the process will run as the user which owns the binary file and not as the user of the evaluator process.