News for hackers. Stuff that matters.

A comment on Remote Code Execution as a Service. Parent comment

Re:Remote Code Execution as a Service by adamgordonbell on Tuesday March 07, 2023 @03:09PM (#35060487)
Oh interesting. What were you imagining as the injection vector?

The earthly backend runs on a modified buildkit so it is running the arbitrary code in a container, but it's also in its own VM. This was simpler then firecracker to get started but turned out to have pretty good performance and alright cost once we started suspending things.

[ Parent | on HN ]
Re:Remote Code Execution as a Service by iueotnmunto on Tuesday March 07, 2023 @03:10PM (#35060509)
More if you're running `provision --vm-name "$UserSuppliedData"` or similar. I don't know how you've built your wrapping tool, so I can't comment on how likely it would be, but I've seen such breakages IRL (I break things for a living ;) )
[ Parent | on HN ]
Re:Remote Code Execution as a Service by brandonschurman on Tuesday March 07, 2023 @03:22PM (#35060647)
Good point, we do have things locked down pretty well in our go code though. The instances can only be provisioned using an API, and that API doesn't allow for arbitrary user-supplied input.
[ Parent | on HN ]