goboxd is an HTTP service written in Go that compiles and runs untrusted code inside isolated sandboxes and returns the result. Optional test cases can be supplied to assert behaviour against expected output. It is built for safe execution of code across many languages, with strict isolation, bounded concurrency, and a plug and play language registry.
- Plug and play language registry driven by YAML, with no Go code change to add a language
- Process isolation using nsjail over Linux namespaces and cgroups
- Bounded concurrency: requests queue on a semaphore rather than failing under load
- Per request resource limits for wall time, memory, and processes
- Per test results with a structured status vocabulary; user code outcomes are
200, not5xx - Liveness, readiness, and build-info endpoints for orchestration
- A built-in web playground for editing code, attaching tests, and running them from the browser
- Fully containerised; the host needs neither Go nor nsjail
Nine languages are registered out of the box: C, C++, Python 3, Bash, Java, JavaScript, Go, Rust, and Verilog.
- Docker with Compose v2
No Go toolchain or system dependencies are required on the host. Everything runs in containers.
git clone https://github.com/nexuls/goboxd.git
cd goboxd
make buildmake build # build the service and nsjail images
make run # start the service on :8080
make dev # start the service with live reload for development
make test # run all tests
make unit # run unit tests
make integration # run end to end tests
make corpus # run the corpus suite for a language
make load # drive the concurrency load suite
make security # run the security test suite
make lint # run static analysisSend a request:
curl -sS -X POST http://localhost:8080/run \
-H 'Content-Type: application/json' \
--data-binary @docs/examples/run_py3.json | jqWith the service running, open http://localhost:8080/playground in a browser.
It is a single self-contained page that drives the same POST /run API: pick a
language, edit the source in the editor, load one of the bundled example
programs, attach test cases (stdin and expected stdout), and run. Results come
back per test with the build output and timing. A status panel reads /info and
/readyz so you can see the registered languages and readiness at a glance, and
snippets can be saved to the browser for later. See Playground
for the full walkthrough.
.
├── cmd/goboxd/ binary entry point
├── internal/ private application packages
├── configs/ language registry and service config (YAML)
├── docs/ api, playground, languages, security, benchmarks, architecture
└── tests/ integration and load suites
- API — endpoints, request and response contract, status vocabulary
- Playground — the built-in web UI for running code from a browser
- Languages — the registry, per-language defaults, adding a language
- Security — the seven closed holes and defence in depth
- Architecture — request flow, packages, concurrency model
- Benchmarks — how concurrency is measured and the results
Contributions are welcome. Open an issue to discuss substantial changes before sending a pull request.
This project is distributed under the GNU General Public License v3.0. See LICENSE for the full text.