Sandboxing user code with Erlang

Question

As far as I know Erlang provides advanced features for error handling and isolation of processes.

I'm building a system that allow user to submit their code to be executed on the shared server environment and need to make it safe.

Requirements are:

• limit CPU and Memory usage individually for each user-process.
• forbid user-process to communicate with other processes (except some processes specially designed for such purpose).
• forbid access to all sytem resources (shell, file system, ...).
• terminate user-process in case of errors or high resource consumption.

Is it possible to to all this with Erlang and keep it performance efficient?

Answer 1

There has been work done on Safe Erlang in the past and you can find several papers about it. The ErlHive project addresses the problem in an interesting way.