[simonw]

Does anyone know what the simplest possible recipe for running a Python script in a WASM sandbox using Spin is?

I basically want to do something like this:

    my-sandbox-cli-tool 'print("hello world")

And have the snippet of Python code I provide run inside a WebAssembly container that runs one of the Python compiled to WASM builds (https://github.com/brettcannon/cpython-wasi-build for example) - with a time limit and restrictions on memory usage, and file system access, and network access.

I am on a continued quest to figure out the cleanest way to achieve this, I have so many projects I would want to build on top of this capability!

[ushakov]

have you tried e2b.dev? it runs lightweight sandboxes using firecracker, python and third-party packages

disclaimer: i work there

[simonw]

Is that something I can run on my own laptop? It says it's "open source" but the docs seem to be for client libraries that need an API key.

[ushakov]

everything, including the infra is open-source (below), but it currently requires more than just your laptop (gcp, nomad, firecracker, postgres, etc.)

this way, we're able to run millions secure sandbox environments

i appreciate asking though and will be forwarding to my team to see if we can come up with a way for users to emulate the execution locally

source code: https://github.com/e2b-dev/infra

[simonw]

My objectives here are pretty specific: I'm building open source Python tools for people to run on their own machines, and I want to add "execute untrusted code" features to those tools (mainly for code written by LLMs) such that people can use those features with a clean 'pip install x' of my software on Mac, Linux and hopefully also Windows.

As such you're probably not the right fit for me, I should be looking more at things like wasmer and wasmtime.

[sitkack]

You are a big pyiodide user? Does it provide a trampoline to create another sibling instance?

[simonw]

I love Pyodide in the browser but I've had trouble running it not-in-the-browser, aside from this experiment with Deno: https://til.simonwillison.net/deno/pyodide-sandbox

[rkunnamp]

Sorry for asking a possibly noob question. Doesn't firecracker vms requires bare metal instances? And does gcp support provisioning bare metal instances? Or is it that you are able to run firecracker on normal vm instances in gcp ?

[ushakov]

GCP supports nested virtualisation

[conroy]

wasmtime works as long as you make sure to include the lib directory

    % wasmtime run --dir .::/ python.wasm -c 'print("hello world")'
    hello world 

disclaimer: I run a code execution API service (https://riza.io/playground) that does this and more (HTTP, packages, etc.)

[simonw]

Wow that's almost what I want.

    wget https://github.com/brettcannon/cpython-wasi-build/releases/download/v3.13.0/python-3.13.0-wasi_sdk-24.zip
    unzip python-3.13.0-wasi_sdk-24.zip
    wasmtime run --dir .::/ python.wasm -c 'print("hello world")'

So far so good! But... it looks like that --dir option mounts the current directory as both readable and writable:

    wasmtime run --dir .::/ python.wasm -c 'print(len(open("python.wasm", "rb").read()))'
    # Outputs 28775526

But malicious code can break the system like this:

    wasmtime run --dir .::/ python.wasm -c 'open("python.wasm", "wb").write(b"blah")'

And now it fails with an error if you try to run it because we over-wrote python.wasm. Even if I move python.wasm out of the current directory I'd still be able to break things by breaking those other lib files.

Although... I guess I could use unix filesystem permissions to make those read-only? That could work.

[conroy]

This is just a limitation of the wasmtime CLI. The full Rust API let's you mount filesystems as read-only. Not sure why it's not exposed as an argument.

[simonw]

Thanks - I just found an open issue for exposing that in the Python API: https://github.com/bytecodealliance/wasmtime-py/issues/251

[compressedgas]

You might need to wrap the wasmtime command in firejail or bubblewrap with appropriate arguments to get the operation restrictions you want.

[sitkack]

While that might be a workable stop gap, there is zero reason why this couldn’t be handle in the wasi shim layer. This is exactly what wasi was designed for.

[michaelmior]

s/disclaimer/shameless plug/ :P Nothing wrong with it, but not really a disclaimer.

[avinassh]

> .::/

whats this magic

[wyldfire]

Wild speculation based on very little understanding of WASI/WASM:

Perhaps "--dir .::/" means treat the host directory "." as the guest directory "/"?