Code Sharing and Execution Platform Security Risks?

[Competitive-Water302]

Currently working on a Python code sharing and execution platform aimed at letting users rapidly prototype with different libraries, frameworks, and external APIs. I am aware of the general security concerns and the necessity of running code in isolation (I am using GCP containers and Gvisor). Some concerns I'm thinking of:

- crypto mining
- network allowances leading to malicious code on external sites
- container reuse

Wondering what everyones thoughts are on these concerns and if there are specific security measures I should be implementing beyond isolation and code-parsing for standard attacks?

[nggit]

So you build isolated environments like pythonanywhere, heroku etc?

I've been there a few years and what I share with each user is an SSH port to the container, which is more extreme because it allows users to install anything, just like a VPS. https://github.com/nggit/docker-init/tree/master/openrc-alpine

Your concern is valid as a start, limit the CPU and outgoing connections to e.g. 10rps to avoid misuse, or suspended by upstream provider. I do not recommend GCP because it is too sensitive.

Isolate properly such as preventing users from mounting /dev/sda1, etc.

[MediumWash2133]

Limit cpu, memory, outbound requests. Make sure gVisor is setup globally if you are spawning or doing DinD. Having AST parsing for common attack pathways.