CodeArena implements defense-in-depth security to safely execute untrusted user code. This document details the security measures implemented across all layers of the system.

Every code execution runs in an isolated Docker container with the following security settings:

container_config = {
    # Network isolation - no network access
    "network_mode": "none",
    
    # Resource limits
    "mem_limit": "256m",
    "memswap_limit": "256m",
    "cpu_period": 100000,
    "cpu_quota": 100000,  # 1 CPU
    "pids_limit": 50,
    
    # Security options
    "read_only": True,
    "security_opt": ["no-new-privileges:true"],
    "cap_drop": ["ALL"],
    
    # User isolation
    "user": "1000:1000",  # Non-root user
}

Custom seccomp profiles restrict system calls to only those required for code execution:

Allowed syscalls:

• Basic I/O: read, write, open, close
• Memory: mmap, munmap, brk
• Process: exit, exit_group
• Time: clock_gettime, gettimeofday

Blocked syscalls:

• Network: socket, connect, bind, listen
• Process creation: fork, vfork, clone (limited)
• System modification: mount, umount, reboot
• Privilege escalation: setuid, setgid, capset

All execution containers run with --network none:

docker run --network none ...

This completely disables:

• Outbound connections
• DNS resolution
• Any network-based attacks

// Sliding window rate limiter
const rateLimit = {
    windowMs: 60000,     // 1 minute window
    maxRequests: 5,      // 5 submissions per window
    keyGenerator: (req) => req.sessionId,
};

const submissionSchema = z.object({
    problemId: z.string().uuid(),
    language: z.enum(['python', 'javascript', 'java', 'cpp']),
    code: z.string()
        .min(1)
        .max(50000),  // 50KB max
});

• Execution output is truncated to prevent log injection
• Special characters are escaped in responses
• Error messages don't expose internal paths

All queries use parameterized statements:

// Safe - parameterized query
await query(
    'SELECT * FROM submissions WHERE id = $1',
    [submissionId]
);

// Never used - string concatenation
// `SELECT * FROM submissions WHERE id = '${submissionId}'`

• Database credentials stored in environment variables
• Connections use SSL in production
• Minimal database user permissions

The worker needs Docker socket access to spawn containers. Protection measures:

1. Workers run as non-root where possible
2. Docker socket mounted read-only when possible
3. Container images are pre-built and trusted

# Secrets stored in environment variables
DATABASE_URL=postgresql://...
REDIS_URL=redis://...

# Never committed to git
# .env files in .gitignore

All security-relevant events are logged:

logger.warning("Execution timeout", 
    submission_id=id,
    language=lang,
    duration_ms=duration
)

Configure alerts for:

• Unusual submission patterns
• Container escape attempts (if seccomp violations logged)
• Rate limit violations
• Resource exhaustion events

• Container isolation with Docker
• Network disabled for execution containers
• Resource limits (memory, CPU, time, PIDs)
• Seccomp profiles for syscall filtering
• Non-root container execution
• Read-only filesystem with tmpfs
• Rate limiting on API endpoints
• Input validation and sanitization
• Parameterized database queries
• Secrets in environment variables
• Security logging and monitoring

If you discover a security vulnerability, please report it responsibly:

1. Do not open a public issue
2. Email security concerns to the maintainer
3. Include detailed reproduction steps
4. Allow reasonable time for a fix before disclosure

• Docker Security Best Practices
• Seccomp Security Profiles
• OWASP Secure Coding Practices