5 ms·

Kind of almost off-topic: I'm working on a project where I must run possibly untrusted JavaScript code. I want to run it in an isolated environment. This looks

Kind of almost off-topic: I'm working on a project where I must run possibly untrusted JavaScript code. I want to run it in an isolated environment. This looks like a very nice solution as I could spin up a microsandbox and securely run the code. I could even have a pool os live sandboxes so I wouldn't even experience the 200ms starts. Because this is OCI-compatible, I could even provide a whole sandboxed environment on which to run that code. Would that be a good use case for this? Are there better alternatives?

appcypher 1y ago
> Would that be a good use case for this? That is an ideal use case > Are there better alternatives? Created microsandbox because I didn't find any
- SwiftyBug 1y ago
  Awesome. This is really good timing. I'm going to give it a try.
- spixy 1y ago
  Windows has built-in sandbox and its good. https://learn.microsoft.com/en-us/windows/security/application-security/application-isolation/windows-sandbox/ https://learn.microsoft.com/en-us/windows/security/applicati...
ericb 1y ago
runsc / gVisor is interesting also as the runsc engine can be run from within Docker/Docker Desktop. gVisor has performance problems, though. Their data shows 1/3rd the throughput vs. docker runtime for concurrent network calls--if that's an issue for your use-case.
apitman 1y ago
You might be able to get away with running QuickJS compiled to WebAssembly: https://til.simonwillison.net/npm/self-hosted-quickjs https://til.simonwillison.net/npm/self-hosted-quickjs
- yencabulator 1y ago
  Convenience helper for that: https://github.com/bytecodealliance/javy https://github.com/bytecodealliance/javy
arjunbajaj 1y ago
I recommend trying Javy[0]. Javy allows you to build a WASM file that includes Javy's JS interpreter along with your JS source code. Note that Javy is a heavily sandboxed environment so it doesn't have access to the internet, or npm modules, a desirable feature for running user code. We're building an IoT Cloud Platform, Fostrom[1] where we're using Javy to power our Actions infrastructure. But instead of compiling each Action's JS code to a Javy WASM module, I figured out a simpler way by creating a single WASM module with our wrapper code (which contains some further isolation and helpful functions), and we provide the user code as an input while executing the single pre-compiled WASM module. [0] https://github.com/bytecodealliance/javy https://github.com/bytecodealliance/javy [1] https://fostrom.io https://fostrom.io

appcypher 1y ago

> Would that be a good use case for this? That is an ideal use case > Are there better alternatives? Created microsandbox because I didn't find any

SwiftyBug 1y ago
Awesome. This is really good timing. I'm going to give it a try.
spixy 1y ago
Windows has built-in sandbox and its good. https://learn.microsoft.com/en-us/windows/security/application-security/application-isolation/windows-sandbox/ https://learn.microsoft.com/en-us/windows/security/applicati...

ericb 1y ago

runsc / gVisor is interesting also as the runsc engine can be run from within Docker/Docker Desktop. gVisor has performance problems, though. Their data shows 1/3rd the throughput vs. docker runtime for concurrent network calls--if that's an issue for your use-case.

apitman 1y ago

You might be able to get away with running QuickJS compiled to WebAssembly: https://til.simonwillison.net/npm/self-hosted-quickjs https://til.simonwillison.net/npm/self-hosted-quickjs

yencabulator 1y ago
Convenience helper for that: https://github.com/bytecodealliance/javy https://github.com/bytecodealliance/javy

arjunbajaj 1y ago

I recommend trying Javy[0]. Javy allows you to build a WASM file that includes Javy's JS interpreter along with your JS source code. Note that Javy is a heavily sandboxed environment so it doesn't have access to the internet, or npm modules, a desirable feature for running user code. We're building an IoT Cloud Platform, Fostrom[1] where we're using Javy to power our Actions infrastructure. But instead of compiling each Action's JS code to a Javy WASM module, I figured out a simpler way by creating a single WASM module with our wrapper code (which contains some further isolation and helpful functions), and we provide the user code as an input while executing the single pre-compiled WASM module. [0] https://github.com/bytecodealliance/javy https://github.com/bytecodealliance/javy [1] https://fostrom.io https://fostrom.io