How to restrict program resources + rights in JVM/OSGi?

Question

I want to create a website where people can solve programming tasks and eventually upload their solution (in any JVM-language) in order to verify it and share it with others.

I figured OSGi (learning it right now) might be a good tool to handle this task (is it?). But obviously I'm a little anxious about letting other people executing their code on my host (btw, a input/output-based solution is no alternative).

So I figured I need to find out

a) how to allow/restrict certain Java functionality (e.g. starting a thread, sending a mail, writing a file etc.)

and

b) how to limit a program's/bundle's CPU/RAM resources so no one could bring the host down with an endless loop for example.

Any suggestions?

Answer 1

b) I think the safest solution would be to create dedicated JVMs for each user-submitted solution. This way, you have all your operating system's tools at hand.

a) Java functionality may be restricted using Permissions. I've never tried to do something sophisticated with it, but it certainly isn't trivial to make a solid policy for 3rd party input. Maybe Google's Appengine SDK might help. I suspect that it is using permissions to mimic Appengine's behaviour locally.