3 ms·

Redis, for example, uses Lua but limits the Lua to a single pure-function and enforces an execution time limit https://redis.io/commands/eval#sandbox-and-maximu

Redis, for example, uses Lua but limits the Lua to a single pure-function and enforces an execution time limit https://redis.io/commands/eval#sandbox-and-maximum-execution-time https://redis.io/commands/eval#sandbox-and-maximum-execution... Whilst the complexity of the script is limited in what it can do, it seems actually not that hard to imagine some kind of next-gen CDN offering edge scripting to statelessly rewrite requests and responses.

majke 10y ago
Lua, in its vanilla form, is not a language supporting proper multi-tenancy. It works okay if only one (trusted) user writes the scripts, but it's not the good choice for running truly untrusted code from the internet. What will just happen when you do "string.rep" in redis? A better design would be to run one Lua VM per tenant, but then we are at totally different set of problems (preemptive multi-tasking between VM's?)
- willvarfar 10y ago
  In Lua its the host that does the actual allocs (lua_setallocf()), and its routine for the host to intercept those mallocs and do accounting. Now even with a 'locked down' Lua VM there is a lot of trust in executing 3rd-party scripts and there might be various attacks. But as I said, I really could imagine some next-gen CDN allowing paying customers to put Lua scripts in the edge to rewrite requests and responses. If I were tackling it I would want all the script instances for any given customer to be isolated at a hardware level from other customers too.