用于安全执行不受信任的程序的沙箱
Isolate is a sandbox built to safely run untrusted executables, like programs submitted by competitors in a programming contest. Isolate gives them a limited-access environment, preventing them from affecting the host system. It takes advantage of features specific to the Linux kernel, like namespaces and control groups.
Isolate was developed by Martin Mareš ([email protected]) and Bernard Blackham ([email protected]) and still maintained by the former author. Several other people contributed patches for features and bug fixes (see Git history for a list). Thanks!
Originally, Isolate was a part of the Moe Contest Environment, but it evolved to a separate project used by different contest systems, most prominently CMS. It now lives at GitHub, where you can submit bug reports and feature requests.
If you are interested in more details, please read Martin's and Bernard's papers on Isolate's design and grading system security published in the Olympiads in Informatics journal. Also, Isolate's manual page is available online.
To compile Isolate, you need:
pkg-config
headers for the libcap library (usually available in a libcap-dev package)
headers for the libseccomp library (libseccomp-dev)
headers for the libsystemd library (libsystemd-dev package) for compilation of isolate-cg-keeper
You may need a2x (found in AsciiDoc) for building manual.
But if you only want the isolate binary, you can just run make isolate
Recommended system setup is described in sections INSTALLATION and REPRODUCIBILITY of the manual page.
Isolate is also available as packages for stable Debian Linux and last two LTS
releases of Ubuntu, all on the amd64 architecture. To use them, create
/etc/apt/sources.list.d/isolate.sources with the following contents:
Types: deb
URIs: http://www.ucw.cz/isolate/debian/
Suites: trixie-isolate
Components: main
Architectures: amd64
Signed-By: /etc/apt/keyrings/isolate.asc
You also need to install the repository's public key:
curl https://www.ucw.cz/isolate/debian/signing-key.asc >/etc/apt/keyrings/isolate.asc
Then invoke:
apt update && apt install isolate
There are experimental packages for the arm64 architecture, too.