Docker Sandboxing

languages_to_docker["c"]="gcc:14"
languages_to_docker["cpp"]="gcc:14"
languages_to_docker["py2"]="python:2"
languages_to_docker["py3"]="python:3"
languages_to_docker["numpy"]="truongan/wecodejudge:numpy"
languages_to_docker["java"]="openjdk:8"
languages_to_docker["pas"]="nacyot/pascal-fp_compiler:apt"
languages_to_docker["js"]="node:20"

#!/bin/bash

# This script is design to run the tester process in a docker container using sudo
# tester process require the $JAIL directory to be shared between the host and the container
# This script check if the sharing folder is the subfolder of ${HOME}
# It's to ensure user cannot abuse the scritp to escalate their privilege and share the whole system to the containter

# Usage: run_judge_in_docker share_directory docker_image command

share_directory=${1}
docker_image=${2}
shift 2
command=$@
owner=`stat -c '%U' $share_directory`
USER=`whoami`
dockername="$USER-$(basename $share_directory)"

if  [ "$owner" = "$USER" ] || [ "$owner" = "$SUDO_USER" ]
then
	docker run --rm \
		-v $share_directory:/work:rw \
		--name=$dockername \
		--network none \
		-u$UID \
		-w /work \
		$docker_image \
		$command
	EC=$?

	exit $EC
else
	echo "Share directory '$share_directory' does not belongs in your home directory '${HOME}'"
fi

TIMELIMIT=${7}        # time limit in seconds (float)
TIMELIMITINT=${8}    # integer time limit (should be > TIMELIMIT)

# Imposing time limit with ulimit
ulimit -t $TIMELIMITINT

if $TIMEOUT_EXISTS; then
    # Run the command with REAL time limit of TIMELIMITINT*2
    timeout -s9 $((TIMELIMITINT*2)) $CMD <$IN >out 2>err
else
    # Run the command
    $CMD <$IN >out 2>err	
fi

MEMLIMIT=${9}         # memory limit in kB

if [ $EXT == "py2" ]; then
    mem=$(pid=$(python2 >/dev/null 2>/dev/null & echo $!) && ps -p $pid -o vsz=; kill $pid >/dev/null 2>/dev/null;)
    MEMLIMIT=$((MEMLIMIT+mem+5000))
elif [ $EXT == "py3" ]; then
    mem=$(pid=$(python3 >/dev/null 2>/dev/null & echo $!) && ps -p $pid -o vsz=; kill $pid >/dev/null 2>/dev/null;)
    MEMLIMIT=$((MEMLIMIT+mem+5000))
fi

languages_to_comm["java"]="java -Xmx${MEMLIMIT}k -Xms${MEMLIMIT}k solution"

OUTLIMIT=${10}        # output size limit in Bytes

$tester_dir/run_judge_in_docker.sh `pwd` ${languages_to_docker[$EXT]} $COMPILER code.$EXT $C_OPTIONS $C_WARNING_OPTION -o $EXEFILE >/dev/null 2>cerr

C_OPTIONS=" -g -O2 -static "
C_WARNING_OPTION="-w"  # Inhibit all warning messages

COMPILER="gcc -std=gnu11"
if [ "$EXT" = "cpp" ]; then
    COMPILER="g++ -std=c++20"
fi

$tester_dir/run_judge_in_docker.sh `pwd` ${languages_to_docker[$EXT]} javac solution.java >/dev/null 2>cerr

grant {
};

/*
 * @file shield.c
 * Shield for C
 *
 * Author:
 *  Mohammad Javad Naderi <[email protected]>
 *
 */

#include "def.h"
 
int themainmainfunction();

int main(int argc, char *argv[])
{

	themainmainfunction();

	return 0;
}

#include "code.c"

JAIL=jail-$RANDOM-`basename $LOGFILE`
if ! mkdir $JAIL; then
    shj_log "Error: Folder 'tester' is not writable! Exiting..."
    shj_finish "Judge Error"
fi
cd $JAIL

errors["SHJ_TIME"]="Time Limit Exceeded"
errors["SHJ_MEM"]="Memory Limit Exceeded"
errors["SHJ_HANGUP"]="Process hanged up"
errors["SHJ_SIGNAL"]="Killed by a signal"
errors["SHJ_OUTSIZE"]="Output Size Limit Exceeded"

if [ "$EXT" = "java" ]; then
    if grep -iq -m 1 "Too small initial heap" out || grep -q -m 1 "java.lang.OutOfMemoryError" err; then
        shj_log "Memory Limit Exceeded java"
        echo "<span class=\"text-warning\">Memory Limit Exceeded</span>" >>$RESULTFILE
        continue
    fi
    if grep -q -m 1 "Exception in" err; then
        javaexceptionname=`grep -m 1 "Exception in" err | grep -m 1 -oE 'java\.[a-zA-Z\.]*' | head -1 | head -c 80`
        javaexceptionplace=`grep -m 1 "$MAINFILENAME.java" err | head -1 | head -c 80`
        shj_log "Exception: $javaexceptionname\nMaybe at:$javaexceptionplace"
        if $DISPLAY_JAVA_EXCEPTION_ON && grep -q -m 1 "^$javaexceptionname\$" ../java_exceptions_list; then
            echo "<span class=\"text-warning\">Runtime Error ($javaexceptionname)</span>" >>$RESULTFILE
        else
            echo "<span class=\"text-warning\">Runtime Error</span>" >>$RESULTFILE
        fi
        continue
    fi
fi