bay

README

bay

API for creating Docker jails to run untrusted code.

Bay is a golang library/server to expose a simple API to run untrusted code in a Docker container. Obviously, this means it is Linux only and all the security concerns around running untrusted code in a Linux contianer still apply. It currently supports images for Go, Ruby, Python, C, C++, Perl, asf, so on so forth. If you plan on using it create several dockers at once, I would suggest you use docker swarm. This is easy to do in Bay and takes one configuration option listed below. You will also want to follow the best practices for setting up docker swarm as well (TLS and such).

Security

Can't stress this enough. YOU need to make sure you follow the best practices for running Linux containers. This library does not magically lock down your containers in a complete safe and isolated manner. Bay is only as strong as Docker. Checkout these resources regarding Docker security.

• The Docker Security article from Docker.io.
• The LXC, Docker, Security slides from Jérôme Petazzoni.
• The series of Docker security articles from Daniel J. Walsh (one, two).
• The Linux Audit for some additional best practices.

Install

go get github.com/Vluxe/bay

Docs

Overview/How to Use

TODOs

things...

License

Bay is licensed under Apache v2.

Contact

...

Documentation

Index

• func Start(address string, c *Config) error
• type Build
• type Config
• type User

Functions

func Start

func Start(address string, c *Config) error

Start get this API party started. It is just the http listener to start handling routes.

Types

type Build

type Build interface {
	PreBuild(buildDir, lang string, err error)                     // PreBuild gets called before the docker image is built.
	PostBuild(container *docker.Container, lang string, err error) // PostBuild is called after the docker image is built.
}

Build is type for implementing callback functions set in your config.

type Config

type Config struct {
	CPU            int64  // Cpu is the number of CPUs allowed by each container.
	Memory         int64  // Memory is the amount of memory allowed by each container.
	DockerUrl      string // DockerUrl is the url to your docker instance. Generally your swarm url.
	Cert           string // Cert is your TLS certificate for connecting to your docker instance.
	Key            string // Key is your TLS key for connecting to your docker instance.
	Ca             string // Ca is your TLS ca for connecting to your docker instance.
	BuildInterface Build  // BuildInterface is the Build Interface.
}

Config is a type for configuring the properties of bay.

type User

type User struct {
	Name     string `json:"name"`
	Email    string `json:"email"`
	Username string `json:"username"`
}