RCE Engine

A production-grade microservices platform for securely executing untrusted code. Implements a "Defense-in-Depth" security model using ephemeral Docker containers and Go orchestration.

Defense-in-Depth Security Model

• Network Isolation: Containers spawned with NetworkDisabled: true to prevent external calls
• Capability Dropping: All Linux capabilities (CapDrop: ["ALL"]) removed, no-new-privileges enforced
• Resource Quotas: Hard limits on RAM (128MB), CPU (0.5 cores), and PIDs (max 50) to prevent Fork Bombs
• Ephemeral Lifecycle: Containers utilize AutoRemove flag, ensuring immediate destruction after 5-second timeout

High-Performance Orchestration (Go)

• Sibling Container Pattern: Worker communicates with host Docker socket to spawn sibling containers, reducing overhead vs Docker-in-Docker
• Throughput: System processes submissions with <500ms overhead, excluding runtime

Tech Stack

• Frontend: React 18, TypeScript, Vite, Monaco Editor
• Backend: Node.js (API Gateway), Go (Execution Engine), Python (Static Analysis)
• Infrastructure: Docker, Nginx (Reverse Proxy), Redis (Message Queue)
• Database: MongoDB (Persistence), Redis (Caching/Queues)
• Observability: Prometheus, Grafana, cAdvisor