I want to create windows service which recieves via some queue tasks to run a lot of console applications simultaneously. Also I want to make my server safe. Just because anybody can upload a virus to my server and schedule it to run. Applications can be written on Java, C#, they can be also native applications, written on pure C.
The easiest way is using virtual machine to run applications. But VM gets a lot of resources to run and in fact, with each VM I will run separate copy of Windows, which takes a lot of memory and processor resources.
The second way is writting filesystem minifilter kernel driver to control filesystem and windows registry. I can make isolated folder and restrict all access to other folders. Also I can to make quotas for each running thread and process. But I cant control memory, which can be used to hack my sandbox.
Ideally I need a solution where I can to run application in the sandbox, also I need to control this sandbox (clean it, deploy new application into it, running just deployed app, to copy log files from sandbox).
I just found solution. The solution is using ReactOS as guest OS on VirtualBox. So because I want to create “computing cluster” using 4-5 PCs and approx 20 guest OSes on each, I need to have guest OS, that eats not a lot of memory. ReactOS eats approx 25 Mb or RAM. And 25 to video card emulation and other VirtualBox stuff. I will create deployment service to deploy applications I need to run into ReactOS. After that guest OS will be notified about deployment finishing and will run deployed application. After app finishes working, all log will be copied to host and guest VM will be rolled back to snapshot. So, if somebody will upload a virus, all results of its work will be cleared automatically. And I can run a lot of copies because ReactOS eats just 25-30 Mb of RAM