3 ms·

It is absurd for any user to use a half baked Python interpreter, also one that will always majorly lag behind CPython in its support. I advise sandboxing CPyth

It is absurd for any user to use a half baked Python interpreter, also one that will always majorly lag behind CPython in its support. I advise sandboxing CPython instead using OS features.

avaer 9mo ago
The repo does make a case for this, namely speed, which does make sense.
- sd2k 9mo ago
  True, but while CPython does have a reputation for slow startup, completely re-implementing isn't the only way to work around it - e.g. with eryx [1] I've managed to pre-initialize and snapshots the Wasm and pre-compile it, to get real CPython starting in ~15ms, without compromising on language features. It's doable! [1] https://github.com/eryx-org/eryx https://github.com/eryx-org/eryx
- OutOfHere 9mo ago
  Speed is not a feature if there isn't even syntax parity with CPython.
  - maxbond 9mo ago
    Not having parity is a property they want, similar to Starlark. They explicitly want a less capable language for sandboxing. Think of it as a language for their use case with Python's syntax and not a Python implementation. I don't know if it's a good idea or not, I'm just an intrigued onlooker, but I think lifting a familiar syntax is a legitimate strategy for writing DSLs.
    - OutOfHere 9mo ago
      Not having syntax parity with Python == not Python. End of story. The title stays "Python interpreter" which accordingly it is not.
      - deleted 9mo ago
        [deleted]
bityard 9mo ago
Python already has a lot of half-baked (all the way up to nearly-fully-baked) interpreters, what's one more? https://en.wikipedia.org/wiki/List_of_Python_software#Python_implementations https://en.wikipedia.org/wiki/List_of_Python_software#Python...
simonw 9mo ago
How do I sandbox CPython using OS features? (Genuine question, I've been trying to find reliable, well documented, robust patterns for doing this for years! I need it across macOS and Linux and ideally Windows too. Preferably without having to run anything as root.)
- OutOfHere 9mo ago
  Docker and other container runners allow it. https://containers.dev/ https://containers.dev/ allows it too. https://github.com/microsoft/litebox https://github.com/microsoft/litebox might somehow allow it too if a tool can be built on top of it, but there is no documentation.
  - simonw 9mo ago
    Every time I use Docker as a sandbox people warn me to watch out for "container escapes". I trust Firecracker more because it was built by AWS specifically to sandbox Lambdas, but it doesn't work on macOS and is pretty fiddly to run on Linux.
    - OutOfHere 9mo ago
      I think ChatGPT can do a much better job than I can for guiding how to safely use Docker as a sandbox: /share/69875282-1e38-8012-b627-7c0a678f9365 It's not industrial-grade safety for public use, but it'll do for personal use. Other tools for it are also mentioned.
    - its-summertime 9mo ago
      Outside of VM usage, the answer seems to be (on top of containerization and selinux) writing a tight seccomp filter. Gleaned from https://github.com/containers/bubblewrap/blob/0c408e156b12ddc9097b06ce0a7bdab7085a9af2/README.md#system-security https://github.com/containers/bubblewrap/blob/0c408e156b12dd... and https://github.com/containers/bubblewrap/tree/0c408e156b12ddc9097b06ce0a7bdab7085a9af2/demos https://github.com/containers/bubblewrap/tree/0c408e156b12dd...
- nickpsecurity 9mo ago

It is absurd for any user to use a half baked Python interpreter, also one that will always majorly lag behind CPython in its support. I advise sandboxing CPython instead using OS features.

avaer 9mo ago

The repo does make a case for this, namely speed, which does make sense.

sd2k 9mo ago
True, but while CPython does have a reputation for slow startup, completely re-implementing isn't the only way to work around it - e.g. with eryx [1] I've managed to pre-initialize and snapshots the Wasm and pre-compile it, to get real CPython starting in ~15ms, without compromising on language features. It's doable! [1] https://github.com/eryx-org/eryx https://github.com/eryx-org/eryx
OutOfHere 9mo ago
Speed is not a feature if there isn't even syntax parity with CPython.
- maxbond 9mo ago
  Not having parity is a property they want, similar to Starlark. They explicitly want a less capable language for sandboxing. Think of it as a language for their use case with Python's syntax and not a Python implementation. I don't know if it's a good idea or not, I'm just an intrigued onlooker, but I think lifting a familiar syntax is a legitimate strategy for writing DSLs.
  - OutOfHere 9mo ago
    Not having syntax parity with Python == not Python. End of story. The title stays "Python interpreter" which accordingly it is not.
    - deleted 9mo ago
      [deleted]

bityard 9mo ago

Python already has a lot of half-baked (all the way up to nearly-fully-baked) interpreters, what's one more? https://en.wikipedia.org/wiki/List_of_Python_software#Python_implementations https://en.wikipedia.org/wiki/List_of_Python_software#Python...

simonw 9mo ago

How do I sandbox CPython using OS features? (Genuine question, I've been trying to find reliable, well documented, robust patterns for doing this for years! I need it across macOS and Linux and ideally Windows too. Preferably without having to run anything as root.)

OutOfHere 9mo ago
Docker and other container runners allow it. https://containers.dev/ https://containers.dev/ allows it too. https://github.com/microsoft/litebox https://github.com/microsoft/litebox might somehow allow it too if a tool can be built on top of it, but there is no documentation.
- simonw 9mo ago
  Every time I use Docker as a sandbox people warn me to watch out for "container escapes". I trust Firecracker more because it was built by AWS specifically to sandbox Lambdas, but it doesn't work on macOS and is pretty fiddly to run on Linux.
  - OutOfHere 9mo ago
    I think ChatGPT can do a much better job than I can for guiding how to safely use Docker as a sandbox: /share/69875282-1e38-8012-b627-7c0a678f9365 It's not industrial-grade safety for public use, but it'll do for personal use. Other tools for it are also mentioned.
  - its-summertime 9mo ago
    Outside of VM usage, the answer seems to be (on top of containerization and selinux) writing a tight seccomp filter. Gleaned from https://github.com/containers/bubblewrap/blob/0c408e156b12ddc9097b06ce0a7bdab7085a9af2/README.md#system-security https://github.com/containers/bubblewrap/blob/0c408e156b12dd... and https://github.com/containers/bubblewrap/tree/0c408e156b12ddc9097b06ce0a7bdab7085a9af2/demos https://github.com/containers/bubblewrap/tree/0c408e156b12dd...
nickpsecurity 9mo ago