Secure Code Execution

Who Needs Secure Code Execution?

Online Judges

LeetCode-style platforms that evaluate user solutions

Code Playgrounds

Interactive environments like CodePen, Replit, or JSFiddle

Educational Platforms

Coding bootcamps and tutorial sites with runnable examples

API Services

Code execution APIs for third-party integrations

Common Attack Vectors

When accepting code from untrusted sources, you need to defend against:

Fork bombs: :(){ :|:& };: - crashes systems via process exhaustion
Resource exhaustion: Memory allocation loops, disk filling
Data exfiltration: Sending environment variables or secrets to external servers
Container escapes: Exploiting kernel vulnerabilities to break out of isolation
Cryptomining: Using your compute resources for cryptocurrency mining

How BoxLite Protects You

import boxlite

async def run_user_code(code: str, language: str) -> dict:
    async with boxlite.SimpleBox(
        image=get_image(language),
        memory_mb=256,       # Limit memory
        cpus=1,               # Limit CPU
    ) as box:
        try:
            result = await asyncio.wait_for(
                box.exec("python", "-c", code),
                timeout=10.0   # 10 second timeout
            )
            return {
                "success": result.exit_code == 0,
                "output": result.stdout,
                "error": result.stderr
            }
        except asyncio.TimeoutError:
            return {"success": False, "error": "Execution timed out"}

Defense in Depth

BoxLite provides multiple layers of protection:

Attack	Protection
Fork bombs	Process limits + cgroup constraints inside VM
Memory exhaustion	Hard memory limit per sandbox
Infinite loops	Configurable execution timeout
Network attacks	Isolated network (or disabled entirely)
Container escapes	VM boundary (separate kernel)
Host filesystem access	No host mounts by default

Multi-Language Support

BoxLite runs any OCI/Docker image, so you can support any language:

LANGUAGE_IMAGES = {
    "python": "python:3.12-slim",
    "javascript": "node:20-slim",
    "rust": "rust:1.75-slim",
    "go": "golang:1.21-alpine",
    "java": "openjdk:21-slim",
    "cpp": "gcc:13",
}