Package: epicbox
epicboxA Python library to run untrusted code in secure, isolatedDockerbased sandboxes. It is used to automatically grade programming assignments
onStepik.org.It allows to spawn a process inside one-time Docker container, send data
to stdin, and obtain its exit code and stdout/stderr output.  It's very similar
to what thesubprocessmodule does but additionally you can specify a custom environment for the process
(a Dockerimage)
and limit the CPU, memory, disk, and network usage for the running process.UsageRun a simple Python script in a one-time Docker container using thepython:3.6.5-alpineimage:importepicboxepicbox.configure(profiles=[epicbox.Profile('python','python:3.6.5-alpine')])files=[{'name':'main.py','content':b'print(42)'}]limits={'cputime':1,'memory':64}result=epicbox.run('python','python3 main.py',files=files,limits=limits)Theresultvalue is:{'exit_code':0,'stdout':b'42\n','stderr':b'','duration':0.143358,'timeout':False,'oom_killed':False}Available Limit OptionsThe available limit options and default values:DEFAULT_LIMITS = {
    # CPU time in seconds, None for unlimited
    'cputime': 1,
    # Real time in seconds, None for unlimited
    'realtime': 5,
    # Memory in megabytes, None for unlimited
    'memory': 64,

    # limit the max processes the sandbox can have
    # -1 or None for unlimited(default)
    'processes': -1,
}Advanced usageA more advanced usage example ofepicboxis to compile a C++ program and then
run it multiple times on different input data.  In this exampleepicboxwill
run containers on a dedicatedDocker Swarmcluster instead of locally installed Docker engine:importepicboxPROFILES={'gcc_compile':{'docker_image':'stepik/epicbox-gcc:6.3.0','user':'root',},'gcc_run':{'docker_image':'stepik/epicbox-gcc:6.3.0',# It's safer to run untrusted code as a non-root user (even in a container)'user':'sandbox','read_only':True,'network_disabled':False,},}epicbox.configure(profiles=PROFILES,docker_url='tcp://1.2.3.4:2375')untrusted_code=b"""// C++ program#include <iostream>int main() {int a, b;std::cin >> a >> b;std::cout << a + b << std::endl;}"""# A working directory allows to preserve files created in a one-time container# and access them from another one. Internally it is a temporary Docker volume.withepicbox.working_directory()asworkdir:epicbox.run('gcc_compile','g++ -pipe -O2 -static -o main main.cpp',files=[{'name':'main.cpp','content':untrusted_code}],workdir=workdir)epicbox.run('gcc_run','./main',stdin='2 2',limits={'cputime':1,'memory':64},workdir=workdir)# {'exit_code': 0, 'stdout': b'4\n', 'stderr': b'', 'duration': 0.095318, 'timeout': False, 'oom_killed': False}epicbox.run('gcc_run','./main',stdin='14 5',limits={'cputime':1,'memory':64},workdir=workdir)# {'exit_code': 0, 'stdout': b'19\n', 'stderr': b'', 'duration': 0.10285, 'timeout': False, 'oom_killed': False}Installationepicboxcan be installed by runningpip install epicbox. It's tested on Python 3.4+ and
Docker 1.12+.You can also check theepicbox-imagesrepository that contains Docker images used to automatically grade programming
assignments onStepik.org.ContributingContributions are welcome, and they are greatly appreciated!
More details can be found inCONTRIBUTING.