Comment by bArray
1 month ago
I have been thinking about this myself, but am still not convinced about how to run untrusted Python code. I'm not convinced that the right solution is to run the code as WebASM [1].
I have been looking towards some kind of quick-start qemu option as a possibility, but the project will take a while.
I see what you mean, but i think there is room for both approaches.
If we want to isolate untrusted code at a very fine-grained level (like just a specific function), VMs can feel a bit heavy due to the overhead, complexity etc
What you really want to do is decouple the sandbox specification annotations from the sandbox implementation backend, yes?
What's the problem with WASM? It's a mature target, and was created primarily, if not solely, for running untrusted native code.