Question: I have to mark C code and part of that involves running and timing their submissions. The problem is that their code then runs as me and they can in principle do whatever they like using my permission settings. For example, they could copy my ssh private key.

I could set up a virtual machine and run their code within it (although I am not entirely sure of the best way to lock this down either). A problem with this is that the speed performance will now not be realistic. I could provide the same virtual machine to all the users to test their code on beforehand so at least they have the same set up to test with. 

Is there a good way to set up an environment where you can run code written by others but limit the damage it can do?

Answer: 
There are actually multiple types of virtual machines, which is kinda being missed in the other answers. You can have what's known as container virtualisation - something like Linux vServer or OpenVZ. They share the host kernel, running what are known as 'containers' (with their own environments) rather than virtualising any hardware, and are [almost as fast as bare metal](https://openvz.org/FAQ#What_is_the_performance_overhead.3F). (OpenVZ is more common in cheaper VPS services, but only supports up to a custom kernel 2.6.x, while vServer goes up to latest stable).

Apart from that, the overhead of full virtualisation on a modern machine isn't as bad as you think! With hardware virtualisation on a mid-high end CPU, most uses wouldn't even notice any performance penalty, unless there was contention for resources (e.g. the host or another VM was using a lot). It will be a little slower, because some resources are used by the guest OS, but the cost of the virtualisation itself is almost negligible - especially CPU usage, since that can be passed to the raw hardware with (almost) no translation, if it's hardware accelerated. You could try it, you might be surprised.

---

Note that each also comes with differing levels of isolation. Container virtualisation makes it much easier to exploit kernel and other bugs to 'break out' of the container - LXC is not secure at all, though OpenVZ is considered pretty mature and secure (and is commonly used in VPS services, where you're selling containers to untrusted people). vServer is somewhere in between. Full virtualisation has better isolation, but some attacks still exist to break out.

It depends just how far you expect a malicious student to go. It might be sufficient to simply run as a different user. You might want a container for more security. Chances are that a container is enough for anything you'll encounter in these circumstances.
`I have to mark C code`

Then you have full access to the source code, Look though it - its doubtful they will be able to pass off anything malicious in the code without you noticing. 

If your unsure run it though a VM, but in most cases you will know what is being run