Comment by sd2k
7 hours ago
I posted this elsewhere in the thread, and don't want to spam it everywhere (or take away from Amla!), but you might be interested in eryx [1] - the Python bindings [2] get you a similar Python-in-Python sandbox based on a WASI build of CPython (props to the componentize-py [3] people)!
[1]: https://github.com/sd2k/eryx/
That's really cool.
Any chance you could add SQLite?
Filed a feature request here: https://github.com/eryx-org/eryx/issues/28
It looks like there's not mechanism yet in the Python bindings for exposing callback functions to the sandboxed code - it exists in the Rust library and Python has a ExecuteRusult.callback_invocations counter so presumably this is coming soon?
Good call, yes, I'll get that added soon!
How does this all compare to using pyodide?
I'm not super familiar with how pyodide works but I think it uses CPython compiled with Emscripten then needs to be run from a Javascript environment, and uses the browser's (or Node's) Wasm engine.
This uses CPython compiled to WASI and can (in theory) be run from any WASI-compatible Wasm runtime, in this case wasmtime, which has bindings in lots of languages. WASI uses capability based security rather than browser sandboxing and lets the host intercept any syscalls which is pretty cool. Wasmtime also lets you do things like epoch-based interruption, 'gas' for limiting instruction count, memory limits, and a bunch of other things that give you tons of control over the sandbox.
Pyodide/Emscripten might offer something similar but I'm not sure!
A lot of it IS using Pyodide, but wrapping it in a way that's convenient to use not-in-a-browser.