0

I'm working on a project that automatically compiles, executes and tests the output of submitted programs in C, C++, Java and Python. Obviously this needs to happen inside some sort of secured environments since any kind of code can be submitted. After trying to create the container myself with a chroot jail, which ended up not being practical, I turned to containers.

Now, say I have a C program which takes an int i as argument, and returns that i+1. I want to write a script that copies the C program (let's say plusone.out), together with a list of test inputs (input.txt) to an LxC container, executes the program inside the container, writes the outputs to a file (output.txt), and exports that file back to the host system so the main application (that runs outside the container) can check the results. There also need to be some restrictions on the resources, but I can do that with LxC's inbuilt cgroups implementation.

I know how to do most of the stuff outlined above, but for the life of me I can't find out how to copy files from the host to the container or the other way around. Every tutorial I see demonstrates behavior by running ls or echo inside the container, but never importing a script or program from the host system. Can anyone help me, or possibly refer me to documentation that can tell me how to accomplish this?

  • 1
    Save yourself a lot of grief and look into Docker. – Michael Hampton Apr 18 '15 at 17:07
0

Is this running on a web server? If so, make sure the host and containers are really locked down. If it's on a public facing website, make doubly sure (it sounds like you know to do this, but thought I'd mention it)

Copy the binary directly to the container filesystem

Assuming your host 'executor' program has root privs, try the following:

cp test_runner /var/lib/lxc/<container_name>/rootfs/tmp/

Rootfs is the raw filesystem for the container. You would then execute your script by doing something like:

lxc-attach -n container -- /tmp/testprogram

If it's not running as root, try using unprivileged containers (this might actually be better from a security standpoint). You could then copy the file directly to the container without needing root. Stephane Graber (one of the lxc developers for ubuntu) has a great intro on his blog: Introduction to Unprivileged LXC Containers

  • Funnily enough you submitted this answer on the very day I finished my project. I went with Docker like the commenter on my question suggested, but it looks like your answer might've been very helpful if I would've chosen LXC, so I'm accepting it anyway. Thanks! – Ghijs Kilani Jun 9 '15 at 11:02
  • Fantastic! Glad it helped. – user71931 Jun 10 '15 at 0:45

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.