[metadat]

  import requests 
  
  r = requests.get('https://theonion.com')
  
  print(r.text)

Hmm, I wonder if you could use subprocess to fetch and run any binary. What kind of sandbox is this running in, and what are the limits?

Running arbitrary untrusted code seems like a potential security issue.

Edit: @porridgeraisin Got it, thanks! Does this mean outbound http requests only work with domains that support arbitrary requests via `Access-Control-Allow-Origin: *` ?

[andycloke]

Maker here! Runs in an isolated Web Worker using Web Assembly, via Pyodide. Everything runs locally in your browser - no file system or other access. Scheduled run (paid plan) run on AWS lambda.

So, yes, sadly, network requests only work with domains with Access-Control-Allow-Origin: *. I'm looking at adding a backend CORS proxy to fix this.

We also have a Chrome extension with no CORS limitation. The extension lets you right-click Python code snippets on basically any site (Claude, ChatGPT, Deepseek etc.) to run it instantly.

https://chromewebstore.google.com/detail/python-code-runner/...

[metadat]

You might check out https://e2b.dev, they already have a really robust sandbox system with nice SDKs.

[andycloke]

Interesting, thanks

[hoodchatham]

Yes, it has all the normal CORS restrictions. If you're curious, the PR that added support for this is here: https://github.com/urllib3/urllib3/pull/3195

[porridgeraisin]

It runs on pyodide, i.e, a wasm interpreter that runs entirely in your browser.