docker - 通过Ajax使用Docker执行沙盒命令

Question

我正在寻求有关此事的帮助，如果我想沙漏执行网站中键入的命令，我有什么选择？我想为一种编程语言创建一个在线解释器。

我一直在寻找docker，我将如何使用它？这是最好的选择吗？

Answer 1

codecube.io执行此操作。它是开源的:https://github.com/hmarr/codecube

作者写了他的rationale and process。系统的运作方式如下:

• A user types some code in to a box on the website, and specifies the language the code is written in
• They click “Run”, the code is POSTed to the server
• The server writes the code to a temporary directory, and boots a docker container with the temporary directory mounted
• The container runs the code in the mounted directory (how it does this varies according to the code’s language)
• The server tails the logs of the running container, and pushes them down to the browser via server-sent events
• The code finishes running (or is killed if it runs for too long), and the server destroys the container

Docker容器的入口点是 entrypoint.sh，它在容器中运行:

prog=$1
<...create user and set permissions...>
sudo -u codecube /bin/bash /run-code.sh $prog

然后 run-code.sh检查扩展名并运行相关的编译器或解释器:

extension="${prog##*.}"
case "$extension" in
  "c")
    gcc $prog && ./a.out
    ;;
  "go")
    go run $prog
    ;;
<...cut...>

The server that accepts the code examples from the web, and orchestrates the Docker containers was written in Go. Go turned out to be a pretty good choice for this, as much of the server relied on concurrency (tailing logs to the browser, waiting for containers to die so cleanup could happen), which Go makes joyfully simple.

作者还详细介绍了他如何实现资源限制，隔离和安全性思想。