About

Contester runs submitted programs inside isolate, the sandbox used by the International Olympiad in Informatics. Each run gets its own control group, its own network namespace and a read-only view of the filesystem.

Time limits are enforced against CPU time rather than wall clock, so a program is judged on what it did, not on how busy the machine was. Memory limits are enforced by the kernel rather than sampled, which is why an over-limit program reports MLE instead of failing unpredictably.

Compilers are treated as untrusted input too. They run in the same sandbox, with their own budget, so a program designed to hang the compiler fails the submission rather than the judge.