How to make safe execution of user code (lambda, function as a service)?

Question

linux

Different users store data on the server. I also want to give users the opportunity to manage their own data a little according to their own logic. (for example: when uploading a new file or every N minutes, call a user script that, for example, will count the number of files and the total size and write it to some other file).

What programming language does not matter.

The main requirement is that it must be safe, including:

• The script cannot get root access or access to system files
  
• Script cannot access files of other users
  
• The script cannot load the machine too much (guzzle 100% of the CPU or run forever instead of 3-5 seconds), fork into a thousand processes, daemonize, etc.
  
• The script (I'm not sure here) should not be able to work with the network
  
• The solution must be lightweight. Probably, all the previous points can be satisfied if you run the script inside the docker container, but this, kmk, will eat up a lot of resources
  

So far, a combination of chroot / timeout / ulimit / unshare comes to mind - how good is this? (but I don’t like the idea that you have to store libc and other libs for the script with user data - is it somehow possible to do it beautifully? allow access only to /lib/, /usr/lib/ and /home/username/data).

How powerful is Docker's overhead compared to just running it in a chroot? And what if 100 lambda functions are executed at the same time (100 processes are not a problem even for a simple virtual machine, but 100 docker containers will probably require huge resources?).

Maybe there is some other option? And a lot of all sorts of providers (Amazon, Scaleway) - do they all reinvent their wheel or is there some kind of ready-made solution for this?

Answer 1

There should be a joke about Firecracker running AWS Lambda

Answer 2

The most important thing is to take money from people and keep logs.
As for docker - purely technically, docker imposes some small brakes on the network (in a certain mode, when it proxies the port of the machine to the port in the container) and on the file system (when the container works not with a volume, but with an overlay).
There is no overhead for calculations.
Docker is not virtualization, it's just a neat setup of network namespaces and cgroups. Where do you see zhor resources? Of course, if this is done through kubernetis, which drags about two gigs of its junk, it will be a resource hog.
All the ideas you sketched out are just being implemented with the help of picking in cgroup and network namespaces, so what's the point of repeating docker with your own hands?