Linux – LXC containers as a sandbox environment

containerlxcsandboxSecurityselinux

I am currently starting a project evaluating untrusted programs (student assignments) in a secure sandbox environment. Main idea is to create a web app for GlassFish and Java wrapper around lxc-utils to manage LXC containers. It'll have a queue of waiting programs and a Java wrapper will maintain a fixed number (pool) of LXC containers, assigning each program one (unused) container.

Each container should be secured with SELinux to protect the host system.

My question is: Is it a good idea to create such a mechanism for a sandbox environment, or are there any better fitting solution to this problem? It should be light and secure against student creativity.

Best Answer

You didn't write why you choose LXC as it's not the most secure virtualization solution. I'm heavy user of KVM/XEN and also LXC and I can say this one thing that when it comes to security I never go with Linux containers (no matter if LXC / OpenVZ / VServer). It's just easier (and more reliable) with KVM/XEN.

If it's about performance or hardware requirements then ok - you can try with LXC, but there are some rules You should follow:

  • libvirt ensures strict confinement of containers when using SELinux (thanks to LXC_driver) - not sure though if it's only RHEL/Centos/Fedora case (I don't use Ubuntu/Debian that much) https://www.redhat.com/archives/libvir-list/2012-January/msg01006.html - so going with SELinux is a good idea (in my opinion it's "must have" in such circumstances)
  • Set strict cgroups rules so Your guests doesn't make Your host freeze or affect other containers
  • I'd rather go with LVM based containers - it's always one more layer of "security"
  • Think about network solution and architecture. Do those containers have to communicate with each other?

Start with reading this - it's quite old, but still - there's much knowledge there. And also - meet user namespaces

And after all of that think again - do you really have that much time to play with LXC security? KVM is just so much simpler...

Related Question