isolate

Isolate is a sandbox built to safely run untrusted executables, like programs submitted by competitors in a programming contest. Isolate gives them a limited-access environment, preventing them from affecting the host system. It takes advantage of features specific to the Linux kernel, like namespaces and control groups.

Isolate was developed by Martin Mareš (mj@ucw.cz) and Bernard Blackham (bernard@blackham.com.au) and still maintained by the former author. Several other people contributed patches for features and bug fixes (see Git history for a list). Thanks!

Originally, Isolate was a part of the Moe Contest Environment, but it evolved to a separate project used by different contest systems, most prominently CMS. It now lives at GitHub, where you can submit bug reports and feature requests.

If you are interested in more details, please read Martin's and Bernard's papers on Isolate's design and grading system security published in the Olympiads in Informatics journal. Also, Isolate's manual page is available online.

Installing Isolate

To compile Isolate, you need:

• pkg-config

• headers for the libcap library (usually available in a libcap-dev package)

• headers for the libseccomp library (libseccomp-dev)

• headers for the libsystemd library (libsystemd-dev package) for compilation of isolate-cg-keeper

You may need a2x (found in AsciiDoc) for building manual. But if you only want the isolate binary, you can just run make isolate

Recommended system setup is described in sections INSTALLATION and REPRODUCIBILITY of the manual page.

Debian packages

Isolate is also available as packages for stable Debian Linux and last two LTS releases of Ubuntu, all on the amd64 architecture. To use them, create /etc/apt/sources.list.d/isolate.sources with the following contents:

Types: deb
URIs: http://www.ucw.cz/isolate/debian/
Suites: trixie-isolate
Components: main
Architectures: amd64
Signed-By: /etc/apt/keyrings/isolate.asc

You also need to install the repository's public key:

curl https://www.ucw.cz/isolate/debian/signing-key.asc >/etc/apt/keyrings/isolate.asc

Then invoke:

apt update && apt install isolate

There are experimental packages for the arm64 architecture, too.