title: Secure way to run other people code (sandbox) on my server?
body: <p>I want to make a web service that runs other people's code locally. Naturally, I want to limit their code's access to a certain &quot;sandbox&quot; directory, so that they won't be able to connect to other parts of my server (DB, main webserver, etc.)</p>
  <p>What's the best way to do this?</p>
  <p><strong>Run VMware/Virtualbox:</strong></p>
  <ul>
  <li><p>+ I guess it's as secure as it gets. Even if someone manage to &quot;hack&quot;, they only hack the guest machine</p>
  </li>
  <li><p>+ Can limit the CPU &amp; memory the processes use</p>
  </li>
  <li><p>+ Easy to set up - just create the VM</p>
  </li>
  <li><p>- Harder to &quot;connect&quot; the sandbox directory from the host to the guest</p>
  </li>
  <li><p>- Wasting extra memory and CPU for managing the VM</p>
  </li>
  </ul>
  <p><strong>Run underprivileged user:</strong></p>
  <ul>
  <li><p>+ Doesn't waste extra resources</p>
  </li>
  <li><p>+ Sandbox directory is just a plain directory</p>
  </li>
  <li><p>? Can't limit CPU and memory?</p>
  </li>
  <li><p>? I don't know if it's secure enough</p>
  </li>
  </ul>
  <p><strong>Any other way?</strong></p>
  <p>Server running Fedora Core 8, the &quot;other&quot; codes written in Java &amp; C++</p>