I have to run a non-trusted, third-party application on a linux server.
The program should be run as a specified user for a limited time, for example 30s.
During this period, the program can use all the system resources, but it can write only below a specified directory.
After the program terminates or is terminated because of the timeout, the system have to be cleaned, so it is in exactly the same state as before running the application.
There should not be any descriptors, sockets, spawned processes, files or other system resources left out.
How can I do that?