关于在运行时编译用户自定义C++代码作为程序扩展功能的可行性问询

Great question—this approach is totally feasible, and there are plenty of real-world tools (like game modding frameworks, plugin-based enterprise apps, and security validation utilities) that use similar patterns to enable user-auditable, runtime-compiled C++ code. Let’s break down why it works, and the key considerations to make it secure, robust, and user-friendly:

Runtime C++ compilation is well-supported through multiple practical avenues:

• You can spin up subprocesses with standard compilers like clang++ or g++ to build user code as a standalone subproject—this is straightforward and leverages existing toolchains users might already be familiar with.
• For tighter integration, embedded libraries like libclang or the full LLVM toolkit let you handle compilation directly within your app, giving you more control over the build process and error reporting.

Treating user code as a subproject in the working directory is a smart move: it keeps user code isolated from your core app, makes it trivial for users to inspect, audit, and modify their code, and simplifies dependency management (linking against your closed-source libraries or open-source extensions).

Since your main goal is letting users verify code safety, these steps are non-negotiable:

• Sandbox User Execution: Even if users audit their code, you must run compiled binaries in a restricted sandbox. Use OS-native tools: Linux namespaces/cgroups, Windows Job Objects, or macOS Sandbox to block access to sensitive system resources (file system, network, raw memory) unless explicitly allowed.
• Simplify Source Audits: For open-source extensions, make sure users can access the full source tree (not just headers) and offer optional static analysis hooks. You could integrate clang-tidy with custom security rules to automatically flag risky constructs like unvalidated input calls, raw system() invocations, or unsafe pointer operations.
• Secure Closed-Source Library APIs: When exposing closed-source libraries, lock down the public headers to only safe, abstracted functions. Avoid exposing low-level system calls or raw pointers—wrap them in safe interfaces that enforce security boundaries. Also, sign your closed-source libraries with a digital signature so users can verify their integrity before linking.

• Leverage Lightweight Build Tools: Use script-mode CMake or a custom Makefile generator to handle building user subprojects. This takes care of dependency resolution (linking against your libraries) and lets you enforce security-hardened compilation flags like -fstack-protector, -Werror, and -O2 (balance between safety and performance).
• Clear Feedback for Users: Compilation errors should be human-readable, pointing users directly to issues in their code. For runtime crashes, capture exceptions/signals and report them without leaking sensitive system details—this helps users debug their code without exposing your app’s internals.
• Resource Guardrails: Set strict limits on compilation resources (CPU time, memory, disk space) to prevent users from submitting code that causes infinite loops or resource exhaustion during the build process.

• Performance Overhead: Runtime compilation can be slow for large user projects. Fix this by caching compiled binaries (using code checksums to detect changes) and supporting incremental builds (only recompile modified files).
• API Stability: Keep your public headers backward-compatible—breaking changes will break user code and erode trust. Use semantic versioning and add deprecation warnings for old API functions.
• Cross-Platform Consistency: If targeting multiple OSes, test the compilation flow on Linux, Windows, and macOS to handle compiler-specific flags, library linking differences, and sandboxing tool variations.

内容的提问来源于stack exchange，提问作者Centralized Idea