Is there a safe way to execute code from users/clients in C++? [duplicate]

Question

users/clients compile their C++ code to dynamic library(e.g. libuser.so) and upload to servers on Linux(x64).

Server process opens libuser.so and calls functions in it.

1. How to prevent server process core dump(and other errors) from any errors of libuser.so?
2. How to control the resources of libuser.so can access? (e.g. Memory, disk, and CPU)
3. Maybe there are some evil users/clients.

Answer 1

There is no 100% safe scenario, but usually it goes along following lines:

• Dedicate a special user for this kind of activity
• restrict everything for this user
• whenever libuser needs to be executed, spawn a new process as this special user, chroot into sandbox and pray :