Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to download/compile/run various c/c++ libraries from the net. These are mostly half-baked, obscure and/or abandoned projects, some of them from questionable sources. How can I ensure that they run in a safe "sandbox" type of environment? I mean that they don't touch filesystem/network resources. They should only return values for function calls I make to them.

Preferably a solution for both Win/Linux, but at least for Linux

share|improve this question

migrated from Feb 24 '14 at 16:15

This question came from our site for professional and enthusiast programmers.

Virtual Machine? – Alex K Feb 24 '14 at 16:00
Review the code yourself, then once compiled, its actually trusted. – Ramhound Feb 24 '14 at 16:26
Why the downvotes? – baruch Feb 24 '14 at 18:42
possible cross site duplicate of:… – Ciro Santilli 巴拿馬文件 六四事件 法轮功 Aug 5 '14 at 21:41
subset of:, which also asks for efficiency to run on server – Ciro Santilli 巴拿馬文件 六四事件 法轮功 Aug 6 '14 at 6:39

For Linux, this is ideal workload for a container. You can do this simply using Docker ( This enables containers to be easily created and destroyed in a matter of seconds - far quicker than a VM.

For Windows, you are stuck using a VM as far as I know.

share|improve this answer
I am not sure, but isn't CAMEYO something similar on Windows ? – Devid May 19 '14 at 11:41

Running the software as an unprivileged user is usually enough. Unless you're using a kernel which is vulnerable to root escalation.

sudo adduser SandBoxGuy
sudo passwd SandBoxGuy

Now login as SanBoxGuy and run your software, the software will not be able to access the files of other users or do any damage outside of the SandBoxGuy user's directory.

All that assumes that your kernel is not vulnerable to root escalation.

A bigger answer can be found here. It was written with the Raspberry Pi + Xserver in mind but it more or less suits any Linux system.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .