2025Distributed Systems & Cloud
Distributed Coding Judge
Sandboxed Online Judge Monorepo
Overview
A distributed online judge: an Express API pushes submissions onto Redis queues, workers execute C++17, Python and Node.js code in locked-down Docker containers, and per-test verdicts are stored in PostgreSQL. Users write code in a React + Monaco editor backed by a JWT-secured REST API.
How it works
- 01
Express API and Redis queues decouple request handling from compute-heavy code execution, so workers scale independently.
- 02
JWT-secured REST API; React frontend with the Monaco editor.
- 03
Interactive Code Run: Client transmits code with custom test cases. API server enqueues into run_requests and awaits ephemeral result on run_results:<runId> using Redis BRPOP with a timeout.
- 04
Problem Submission: API stores pending submission in PostgreSQL and pushes onto the problems queue. Background worker runs all test cases, evaluates final verdict, and writes per-test verdicts to PostgreSQL.
- 05
Language workers for C++17, Python 3, and JavaScript (Node.js), each run in an isolated Docker container.
- 06
Production deployment hosted on AWS.
Sandboxing & security
User-submitted code is untrusted, so every run happens inside a locked-down Docker container with layered isolation.
| Control | Config | Why |
|---|---|---|
| Network Isolation | --network=none | Disables outbound network access, preventing SSRF and reverse shells |
| Memory Limit | --memory 128m | Prevents memory exhaustion attacks (OOM denial-of-service) |
| CPU Quota | --cpus 0.5 | Limits CPU usage to prevent CPU starvation |
| Process Cap | --pids-limit 64 | Mitigates fork bombs and process table exhaustion |
| Filesystem Safety | --read-only | Enforces an immutable container filesystem |
| Temporary Scratch Space | --tmpfs /tmp:size=64m,exec | Provides an ephemeral 64MB ramdisk for source compilation |
| Privilege Escalation | --security-opt=no-new-privileges | Blocks setuid binaries and privilege escalation exploits |
| Execution Timeout | 5000ms (TLE) | Forcefully terminates hanging processes via SIGKILL |