基于Docker实现在线评测系统的安全性

Implementation of online evaluation system security based on Docker

现阶段大部分的在线评测系统都采用了C语言编写沙盒的方案,沙盒系统虽然技术较为完备,但是其功能繁琐,实现复杂,在小型评测系统中花费代价太大,并且可移植性较低,不好掌控。本系统另辟蹊径,利用Docker的高隔离特性,规避了使用Docker面临的Root、资源耗尽等风险,并对Docker容器占用的资源做了合理限制,最终实现应用系统和评测系统分离。本系统采用Java开发,Docker容器只需要使用编写好的dockerfile文件就可以一键搭建。相比传统沙盒,本系统具有极高的可移植性,极大提高了技术人员的效率,并且可以更方便的控制在线评测的资源占用以提高CPU和内存的利用效率。

At present,most online evaluation systems adopt the method of writing sandbox with C programminglanguage. Even though the sandbox system enjoys sophisticated technology,it is complex in function and implementation . The cost of implementing sandbox on small online evaluation systems is too high whereas thetransferability and maneuverability is quite low. The system presented in this paper,however,looks at thisproblem from another direction. By taking advantage of the high--isolation feature of Docker,this online evaluation system based on Docker can avoid the risk of Root and resource exhaustion. It achieves the separationof application system and evaluation system by limit the resources deployed by Docker reasonably. Our systemis developed with Java and Docker can be built with one click of the written dockerfile.Compared with traditional sandbox,our system stands out with extremely high maneuverability which enhances tremendously the efficiency of technical personnel and control the resources deployed to improve the utilization efficiency of CPU.