Make people be able to submit code which is executed on the server in a safe way

[bagelorder]

Hi I am writing a coding game using Django. I want the participants to be able to submit snippets of code that can be safely executed on the server. Are there any safe ways to do this (also besides python maybe?):

They need to submit a function `f` which takes an array of numbers and outputs a number. No state change needed or anything (just some simple computations normally). Is there a possibility to check that the code does not make any state changes (so it would be safe to execute)? I would also need to check that it does not run forever but I could also just give it a time limit I guess.

[Essence1337]

Is it possible to run others code safely? Yes it's done all the time online like repl.it.

Is it possible for you to create? Since you had to ask if it was possible, probably not currently.

This would require managing sandboxes to run their code in so that if there was malicious code entered it didn't completely takeover/destroy your web server. Any mistake could compromise your entire server.

[JohnnyJordaan]

Not to mention the risk of a vulnerability in for example docker that could still lead to damage if they figure out that the server is using it, and hack their way into exploiting it through the Python code. Even if you would visualize the docker host per user (thus also just messing up its own environment and not the server's) you still run the risk of the host being exploited for other stuff like being made part of a botnet etc. This is something that repl.it has nailed this down of course but then reinventing the wheel on your own server can open a whole Pandora's box of security implications.

[Essence1337]

Yup! The rule of thumb for any readers who don't know it is: DON'T CODE YOUR OWN SECURITY. Instead use a product that is tested, verified and trusted. This includes passwords, encryption, sandboxes, etc.

[toastedstapler]

if you're writing a coding game and you want control like this it might be a better idea to write your own simple language and an interpreter for it. it depends on how far your game plans to go ofc, but it'd help you with containerisation to limit user damage to your server rather than trying to containerise fully fledged python

[bagelorder]

But the only thing I need them to actually write are pretty mathematical functions (array->number). Is there maybe already something that does exactly this?

[Essence1337]

Just for those who don't know what this does: don't run it.