对运行在服务器上的用户编写的 node.js 脚本进行沙箱化

Question

I'm developing a platform where users can create their own "widgets", widgets are basically js snippets ( in the future there will be html and css too ).

The problem is they must run even when the user is not on the website, so basically my service will have to schedule those user scripts to run every now and then.

I'm trying to figure out which would be the best way to "sandbox" that script, one of the first ideas i had was to run on it's own process inside of a Docker, so let's say the user manages to somehow get into the shell it would be a virtual machine and hopefully he would be locked inside.

I'm not a Docker specialist so i'm not even sure if that makes sense, anyway that would yield another problem which is spinning hundreds of dockers to run 1 simple javascript snippet.

Is there any "secure" way of doing this? Perhaps running the script on an empty scope and somehow removing access to the "require" method?

Another requirement would be to kill the script if it times out.

EDIT: - Found this relevant stackexchange link

Answer 1

This can be done with docker, you would create a docker image with their script in it and the run the image which creates a container for the script to run in.

You could even make it super easy and create a common image, based on the official node.js docker image, and pass in the users custom files at run time, run them, save the output, and then you are done. This approach is good because there is only one image to maintain, and it keeps the setup simple.

The best way to pass in the data would be to create a volume mount on the container, and mount the users directory into the container at the same spot everytime.

For example, let's say you had a host with a directory structure like this.

/users/
     aaron/
     bob/
     chris/

Then when you run the containers you just need to change the volume mount.

docker run -v /users/aaron:/user/ myimagename/myimage
docker run -v /users/bob:/user/ myimagename/myimage

I'm not sure what the output would be, but you could write it to /user/output inside the container and the output would be stored in the users output directory.

As far as timeouts, you could write a simple script that looks at docker ps and if it is running for longer then the limit, docker stop the container.

Because everything is run in a container, you can run many at a time and they are isolated from each other and the host.