如何保护Java应用程序免于内部运行自定义代码？

Question

I develop the container-like application which can accept custom JARs and run some classes from these JAR archives. And I wanr to protect my application from this custom code.

I've found SecurityManager and Policy classes there, but I still don't know how to protect my application from stack overflow attacks and so on.

I've found Runtime class, but I cannot use the separate process because I need to have the instance of the custom class in my application.

What instrument should I use? Or, maybe, I should change the architecture of my application?

Answer 1

I think you are trying to achieve what Google did with GAE . It's not a simple subject to be addressed here so I suppose this paper could be of help.

Answer 2

If you have to do this, it seems better to go for a "chroot jail" or the full virtualisation . (Neither of which I no much about.)