Sandboxing Node.js with CoreOS and Docker
summary
Claimed design runs untrusted customer code with per-job isolation, limits, and network/file restrictions using CoreOS and Docker and off‑the‑shelf primitives. The system executes Node.js and C# via Edge.js inside per-tenant containers, enforces CPU/memory/process caps, and isolates storage and network so one job cannot read another’s data. The demo shows live deployment at Auth0, describes certificate retrieval and request context propagation, and reports the sandbox performs with low overhead and practical fairness.
AI-written summary · about
chapters (5)
related talks
25mCloud-Native Sandboxes for Microservices: Understanding New Threats and Attacks
01h 25mSandboxing a Linux Application
19mSandbox to confidential containers: A brief on the evolution of container isolation
47mSecure Sandboxing in a Post-Spectre World
29mSandbox for Agentic Application With Cloud Native Stack
29mIsolation without Containers
38mSandboxing in Linux with zero lines of code
12mDocker Sandboxes for AI