Question:
I would like to implement validation of training projects i.e. the teacher writes the task and the check, the student completes the task, the student uploads the java file(s) the system checks the tasks.
At the moment the only solution I see is: – Using Junit for tests – Compiling the provided student classes and loading them through your own classloader implementation with permissions set in the SecurityManager
- What is the best way to implement this in java. Are there already similar projects?
- Do I understand correctly that with the help of the SecurityManager I can completely control the implementation of the student (that the student will not get into the file system, the network, start the application execution and will not get into the code being implemented (do I also need to separate the usual classloader from the one I am implementing) ) ?
- I'm not familiar with docker, but as I understand it, it allows you to run isolated applications without eating up extra resources, wouldn't it be a better solution than SecurityManager+classloader ?
Answer:
As a base, I would do this:
- The student receives a .java file with a task template
- A junit test is already ready for this task
- The student uploads the completed task to any drop zone
- The program that checks the task, raises a Docker container with java, connects to it via ssl, compiles this task there using javac, runs JUnit tests and writes a log
- The student receives the processed log
You can build all this using Spring Boot.
Docker is, in my opinion, the best option because it has all the advantages of a virtual machine without being one. For example, you can use this container: https://hub.docker.com/r/library/java/
If using docker causes problems, you can raise a virtual machine using Vagrant, download an image of some Ubuntu with OpenJDK, connect there via SSL and do the same as with docker.
Alternatively, you can also try to compile the code directly at runtime: https://dzone.com/articles/how-to-compile-a-class-at-runtime-with-java-8-and But then you definitely have to touch the SecurityManager .