@Dennis Thanks Dennis

@Pavel anydice.com

Not open source but the language is quite interesting

I considered reimplantation for TIO but could not be bothered ;)

With ASCII charts and all that, you know

@AndrewSavinykh I think I just found what my next project is.

@Dennis @AndrewSavinykh So, I'm presenting TIO to the APL community. I'd like to know a little less vaguely how the sandboxing works. Does every ▶ get a new VM, or how does that work again? Anything else you'd like me to mention?

@Adám Dennis knows the best but since he is not here right now sandboxing works via SELinux en.wikipedia.org/wiki/Security-Enhanced_Linux

@AndrewSavinykh Thanks. That much I do know. Question is what actually runs when pressing ▶.

What do you mean what runs? Your code. There is a web "main" server and several worker or "arena" servers. When you press that button all your input is serialzed/compressed and is sent via ssh from the web server to the worker server. On the worker server context is switched with selinux and then one of the language wrappers run on your input.

As you probably already know the wrappers are here: github.com/TryItOnline/tryitonline/tree/master/wrappers for example this is the one for APL github.com/TryItOnline/tryitonline/blob/master/wrappers/…

@AndrewSavinykh OK. What does "context is switched" mean?

@Adám It means running chcon selinux command linux.die.net/man/1/chcon

basically what sandboxes the process

@AndrewSavinykh Ah, OK. I had it all wrong. So the work servers only run a single SELinux, and then spawn off processes with the sandboxing settings, settings that limit network access, memory usage, and running time?

@Adám yes, there is no VM per process. There are just a few (2 or 3) load balanced arenas, that all run multiple requests simultaneosly using SeLinux for sandboxing

@AndrewSavinykh Great, that's what I wanted to know. Thank you so much. Anything else I should mention?

@Adám This is all open source so anyone can look how this is implemented. The web page runs this javascript github.com/TryItOnline/tryitonline/blob/master/usr/share/… the javascript calls this cgi script when the run button is pressed: github.com/TryItOnline/tryitonline/blob/master/usr/share/…

That one will ssh to arena node and call the following script on it: github.com/TryItOnline/tryitonline/blob/master/bin/run which performs the transition and runs the parser/unpacker from here: github.com/TryItOnline/tryitonline/blob/master/bin/run-sandbox and this one in turn calls one of the wrappers

So that's more or less the whole pipeline

@AndrewSavinykh Thank you for this walk-throug. You should publish it!

@Adám One correction, wipe chcon, paste seunshare linux.die.net/man/8/seunshare (They both are used, it's just the latter that does the sanboxing, not chcon). sorry about the confusion ;)

@AndrewSavinykh Ah, I see, seunshare also changes the context.

@Adám yes it does. seunshare runs the process sandboxed. chcon just sets the security context for some temporary files and directories that the sandboxed process is using.

@AndrewSavinykh How much memory may each thread consume?

@AndrewSavinykh nvm, 1 GB, I presume.

@Adám sorry not sure. hopefully Dennis can answer. The global limits are set here github.com/TryItOnline/tiosetup/blob/master/files/system/… but I have no idea how to interpret this file

Each VM currently have 1GB in total. It is possible that memory is not limited per process - ask Dennis - since the processes are short lived, they are allowed to use as much as they need.

The latter is a conjecture - Dennis would know for sure

@Adám Dennis also set up some zram en.wikipedia.org/wiki/Zram But this mostly to help with languages compilation, (a one time thing that requires a lot of memory) not day-to-day running

And yes, as can be seen from your link above there is also swap

@AndrewSavinykh Confirmed. While I can allocate as much memory as I want, I can only use about 2.5 GB, which seems to fit with 1 GB RAM + 2 GB swap - overhead.

First line is reported available memory. Second line is actual number of bytes of garbage characters, stored in a variable. Third line is reported available memory after the variable has taken its chunk. Binary search to find that 2.6E9 is the max.

@Adám can you check the link?

@AndrewSavinykh Oops, sorry: tio.run/##S0oszvj/…

@Adám is this talk going to be recorded? I kinda want to listen to it but won't be able to actually attend.

@Pavel Yes. I expect it to be live-cast on dyalog.tv and available there again later on.

@Adám Security-Enhanced Linux is a kernel module providing mandatory access controls. Pretty much everything on the servers (cron jobs, the HTTP server, etc.) runs in a confined context; the user-supplied code is only one more. SELinux only controls access (files, network ports, etc.) and capabilities (e.g. suid), but cannot limit memory usage or running time.

The latter two are controlled by the PAM module, the timeout utility, and a simple Bash script that runs in the background and hunts for fork bombs.

@Dennis Cool. I really think you should stich together what Andrew and you wrote to a little "about the technology" page or box.

Unlike runcon, seunshare doesn't simply set a specific context for the sandboxed process. It "unshares" from the default namespace, which allows it to hide other processes from this processes view, and mount temporary directories over /home/runner and /tmp, making sure different sandboxed processes cannot communicate or interfere with each other.

@Dennis Any features (or other things) of TIO you'd like me to mention? I'll be spending a little time on how great you are of course ;-)

;)

@Adám I think the most noteworthy feature of TIO is the number of languages it supports. Even if you don't count the recreational ones, there are still 123 of them. But that would probably have come up in your presentation anyway. ;)

@Dennis It sure will.

@Dennis can you add SNOBOL 4?

@Dennis Can you add SimpleStack? gcc simplestack.c -o simplestack and ./simplestack u source to run. Thanks!