isolate is a sandbox focused on safely executing untrusted programs while limiting their ability to interact with the host system.
It originated in programming contest infrastructure, where submitted executables need to run automatically without being trusted, but its underlying model is useful anywhere controlled execution of arbitrary programs is required. Each sandbox receives a dedicated working area and a restricted view of system resources. The tool is intentionally specialised around process execution rather than providing a general-purpose container management platform.
This is free and open source software.
Key Features
- Uses Linux namespaces to separate sandboxed processes from the host environment.
- Employs control groups to account for and restrict resource consumption.
- Can impose limits on processor time, wall-clock time, memory and other resources.
- Provides a dedicated working directory for each sandbox instance.
- Controls which directories and files from the host are visible inside the sandbox.
- Supports read-only, read-write and temporary filesystem mappings.
- Can mount selected virtual filesystems including proc, sysfs, tmpfs and devpts.
- Provides syscall filtering through seccomp.
- Restricts communication with the outside world unless explicitly permitted.
- Records execution statistics and termination information for the calling system.
- Designed for automated judging systems and other services that repeatedly execute untrusted binaries.
- Includes separate initialisation, execution and cleanup stages so sandbox lifecycle management can be incorporated into larger systems.
Website: github.com/ioi/isolate
Support:
Developer: Martin Mareš and Bernard Blackham
License: GNU General Public License v2.0
isolate is written in C. Learn C with our recommended free books and free tutorials.
Related Software
| Application Sandboxing Tools | |
|---|---|
| Firejail | Linux SUID sandbox for restricting application access |
| bubblewrap | Low-level tool for building unprivileged sandboxes |
| NsJail | Process isolation tool using namespaces, cgroups, and seccomp filters |
| Isolate | Secure execution environment for running untrusted programs with limits |
| Syd | Application sandbox providing configurable filesystem and syscall isolation |
| Hakoniwa | Process isolation tool built around Linux namespaces and security facilities |
Read our verdict in the software roundup.
 LinuxLinks helps you discover the best free and open source software for Linux. Explore our extensive collection of recommended applications, including alternatives to popular proprietary software.We also publish software reviews, Linux tutorials, hardware reviews, free programming books and articles covering the wider open source community. Browse our Linux resources to discover more. Know a useful free and open source Linux application we haven't covered? Suggest a program for inclusion. Has your software been featured on LinuxLinks? Display one of our Featured on LinuxLinks badges on your website or GitHub README. |
Please read our Comment Policy before commenting.