Scastie: use any Scala compiler and Scala library in the browser (opens in new tab)

I am not a pentesting expert. My first reaction is to leave everything as is, as it is a very cool to play with root access to docker containers (I managed to reboot one, but a new one immediately appeared on page reload).

My worst concern now would be network security. With root access, it is trivial to e.g. install spambots in all your containers (just checked, command execution works, and external network access is enabled). I think it is a good idea to at least disable networking. (Update: and use a minimal Docker image like Alpine Linux).

Proof:

[__REDACTED__]

The general rule is that you want as many layers of security as you can get away with without making things impractically inconvenient. In this case, the first step is probably not letting the user's code run as root in the container. Gaining container-root is going to be the first step in many, many exploits and by letting code just run that way, you are giving a potential attacker that step for free.

Disclaimer: Absolutely not a security expert, just someone who is somewhat on the hook for security!

I put together a list of security tips:

https://github.com/wsargent/docker-cheat-sheet#security-tips

Probably the biggest one is to use Virtualbox or another virtual machine so that Docker isn't your only line of defence.

Thumbs up for the honest upfront response!

Maybe Jessica McKellar's "Building and Breaking a Python Sandbox" talk can bring some ideas. (But maybe not! It might be too Python-specific or too language-level whereas you want to remain at a higher level with just Docker)

Video: https://www.youtube.com/watch?v=sL_syMmRkoU

Slides: https://speakerdeck.com/pycon2014/building-and-breaking-a-py...

Congrats Guillaume! How much of ScalaKata code is in there? Sorry if I missed it in the post, but is Scastie open source? I'd love to finally fix scalatutorials.com :) p.s. did you guys consider using a "serverless" architecture to isolate runners instead of docker? Also, are you running it with java -Djava.security.manager? If not then why?

I recommend to at least wrap all the containers in a VM between the docker containers and your server-side orchestration code.

SELinux also helps, from what I've read.

https://news.ycombinator.com/item?id=14245428