Docker timeout for container?

Question

For my dissertation at University, I'm working on a coding leaderboard system where users can compile / run untrusted code through temporary docker containers. The system seems to be working well so far, but one problem I'm facing is that when code for an infinite loop is submitted, E.g:

while True:    print "infinite loop" 

the system goes haywire. The problem is that when I'm creating a new docker container, the Python interpreter prevents docker from killing the child container as data is still being printed to STDOUT (forever). This leads to the huge vulnerability of docker eating up all available system resources until the machine using the system completely freezes (shown below):

So my question is, is there a better way of setting a timeout on a docker container than my current method that will actually kill the docker container and make my system secure (code originally taken from here)?

#!/bin/bash set -e  to=$1 shift  cont=$(docker run --rm "$@") code=$(timeout "$to" docker wait "$cont" || true) docker kill $cont &> /dev/null echo -n 'status: ' if [ -z "$code" ]; then     echo timeout else     echo exited: $code fi  echo output: # pipe to sed simply for pretty nice indentation docker logs $cont | sed 's/^/\t/'  docker rm $cont &> /dev/null 

Edit: The default timeout in my application (passed to the $to variable) is "10s" / 10 seconds.

---

I've tried looking into adding a timer and sys.exit() to the python source directly, but this isn't really a viable option as it seems rather insecure because the user could submit code to prevent it from executing, meaning the problem would still persist. Oh the joys of being stuck on a dissertation... :(

Answer 1

You could set up your container with a ulimit on the max CPU time, which will kill the looping process. A malicious user can get around this, though, if they're root inside the container.

There's another S.O. question, "Setting absolute limits on CPU for Docker containers" that describes how to limit the CPU consumption of containers. This would allow you to reduce the effect of malicious users.

I agree with Abdullah, though, that you ought to be able to docker kill the runaway from your supervisor.

Answer 2

If you want to run the containers without providing any protection inside them, you can use runtime constraints on resources.

In your case, -m 100M --cpu-quota 50000 might be reasonable.

That way it won't eat up the parent's system resources until you get around to killing it.