On demand docker container spinup for safe user code execution

Hi,

We have a unique requirement to handle on-demand container orchestration using firecracker VMS.
We mainly want to execute user code safely in an isolated environment, and when demand is low to shutdown the runners automatically(after some timeout being idle)
[we have a custom runner, which can execute multiple user codes inside a docker container]

We initially thought to use docker container orchestration, but firecracker seems a better alternative.

We also want to implement limits like high memory usage on VMs not to exceed system resources.

Is this possible with Fly?

1 Like

Because we run Firecracker VMs, you should be able to do almost anything inside VMs, including running Docker if you wish, but I think our Machines offering might be what you’re looking for.

Essentially, it’s an API you can use from within an application running on Fly to dynamically create or destroy new Fly machines. So you can have a function in your app that says “create this machine, with this docker image and these constraints, and run this code” and it’ll destroy itself when it’s done.

The only catch is that, if you plan to run untrusted code, you might want to configure your “runner” vm in such a way that it can’t access your internal private network. There are a couple of ways you could do this, but if you’re familiar with docker, you could probably just have your vm’s image run the user code inside of a tightly-controller docker container.

I don’t think we have docs on it yet, but running docker in a Fly VM is definitely possible. We use our own init process instead of systemd, so you have to manually run dockerd &, then you can call docker. (you might also have to disable nftables)

4 Likes

I was thinking of something like this GitHub - fly-apps/fastify-functions: Example Fastify server

We also have a unique requirement that needs to run multiple DB instances. We also want to allow users to run arbitrary SQL commands using different servers(imagine its like SQLFiddle)

  • PostgreSQL
  • MariaDB
  • MSSQL

Is this possible via fly? these DB instances are managed by our API

@allison is there a possibility to arrange a call with someone from your team? we need to discuss this further before investing on fly.io

@kasvith anything you can fit into a docker container is possible with fly.

Fly essentially gives you a full virtual machine, the only difference is provisioning that machine is done using docker images instead of some proprietary format.

You can run any database you want with as many servers as you want (you may need to contact support if you’re needing a very high number as there are soft limits to prevent abuse).

For Databases I believe 3 instances will be enough

Mmhm! The accompanying docs page for that repo is a perfect example of using machines to run user code on demand.

This is absolutely possible! Fly Machines, specifically, are explicitly designed to allow a lot of user control and dynamism, while our Apps are more static, long-running services. Using a sprinkling of both of these components should allow you to build just about anything!

In this case, you could theoretically have an App that calls the internal Fly API to spin up Machines running databases like MySQL or MariaDB (on demand, if you need that!), but you could probably approach this from a couple angles

My recommendation is to get in touch with our support team at support@fly.io. They should be able to help you!

1 Like

Thanks, I will head to support with this ticket

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.