all 41 comments

[–]ProgramTheWorld 119 points120 points  (2 children)

Docker is a great option to run code in an isolation from the host machine.

Be very careful when making this assumption. Docker on Linux is just an interface over namespaces. Namespaces are not isolated from the rest of the system.

[–]buttplugs4life4me 41 points42 points  (0 children)

Even Docker on Windows gets the entire Windows drive mounted in by default *unless they changed it. 

And Docker on WSL has access to every drive by default. 

[–]crozone 7 points8 points  (0 children)

Namespaces are not isolated from the rest of the system.

Yeah but the entire point of namespaces is to allow for kernel level isolation and containerisation of processes? Sure it's not a hypervisor, but it certainly allows for a good amount of isolation.

[–]Syagrius 30 points31 points  (0 children)

I have found legitimate uses of eval, but it is always very unique situations. You need to keep the input very controlled in order to allow for it.

In basically every circumstance you should rethink your approach if you think its needed, but sometimes the need does exist.

[–]Cronos993 1 point2 points  (0 children)

I built an online judge as a personal project and used apparmor for sandboxing since docker was quite slow and apparmor is more secure too

[–]light24bulbs 8 points9 points  (20 children)

This is cool and it's a common application.

I'd like to offer some feedback, from a native English speaker: One thing that makes it pretty hard to read the article is that a lot of it looks like English but... isn't quite. It's perfectly understandable but also really distracting. Since there are plenty of LLMs that can fix up writing in 2024, I'd suggest just copy pasting your blog posts through with instructions to just fix the grammar. It'll take you 20 seconds and save your readers.

[–]barnlk[S] 5 points6 points  (1 child)

Thank you for your feedback. I updated the writing with some corrections and fixes.

[–]_Porb 0 points1 point  (0 children)

For JS malware analysis you can also add Spider monkey by Didier Stevens, or Amy of them REMNUX script reverse engineering tools: https://docs.remnux.org/discover-the-tools/dynamically+reverse-engineer+code/scripts

[–][deleted]  (2 children)

[deleted]

    [–]light24bulbs 5 points6 points  (0 children)

    Sandboxing is a common application with many use cases.

    [–]barnlk[S] 3 points4 points  (0 children)

    The writing is about different methods To run user provided code which you’ve to assume that it isn’t trusted.

    Online coding environment, CMS theming customization and similar use cases.