Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Running Python code in a sandbox with MicroPython and WASM

simonwillison.net

Post reply on HN
Print view View original

41–46 of 46 posts

Re: Running Python code in a sandbox with MicroPython and WASM

#41

Post by apignotti »

binyu wrote: post #40
apignotti wrote: post #39

Earlier quoted context omitted.

The architecture is a fairly straightforward WebAssembly-native monolithic kernel. Most of the complexities come from making things work well within the browser constraints for real world, large apps. We have quite a bit of experience on the topic however, these are previous projects of ours: WebVM ( https://webvm.io ): x86 Debian shell running client-side in the browser via x86 -> WebAssembly JIT compilation Browser…

Oh, you are the author of WebVM, pretty cool! I looked at it while choosing the stack for our project and it seems very solid. Keep up the great work

As a matter of fact WebVM and BrowserPod share the same kernel, the difference is all on the performance side.

WebVM uses x86 virtualization and hence has a significant performance penalty, with the upside of running any existing software without needing the source code.

BrowserPod on the other hand runs WebAssembly binaries at almost native speed. Source code is required, but that is a fair compromise in the world of sandboxing. Most language runtimes and CLI tools are FOSS anyway, and many closed-source tools (such as Claude Code) are written in scripting languages and run on top of FOSS engines.

Re: Running Python code in a sandbox with MicroPython and WASM

#42

Post by andrewaylett »

simonw wrote: post #17
andrewaylett wrote: post #9

Earlier quoted context omitted.

Running arbitrary untrusted code safely is pretty easy nowadays, so long as the code is written in Javascript and you want to run it in a browser. It's only a little harder if the code is written in another language but targets WASM and browser APIs, or if you want to run your WASM inside of NodeJS, and there's even good support for running Python in a browser or Node. Once you get away from running in a JS environme…

I've actually found it pretty hard in a browser as well - if you want to run untrusted code without it breaking your app or stealing cookies etc. I've been doing a bunch of work recently with iframe sandbox combined with CSP which appears to be a robust way to do this.

Fair -- but I was more meaning that when I browse an arbitrary untrusted website I almost always allow the site owner to run arbitrary untrusted code on my machine. They might not send me any JS, but if they do then my browser will happily execute it.

Re: Running Python code in a sandbox with MicroPython and WASM

#44

Post by binyu »

apignotti wrote: post #41
binyu wrote: post #40

Earlier quoted context omitted.

Oh, you are the author of WebVM, pretty cool! I looked at it while choosing the stack for our project and it seems very solid. Keep up the great work

As a matter of fact WebVM and BrowserPod share the same kernel, the difference is all on the performance side. WebVM uses x86 virtualization and hence has a significant performance penalty, with the upside of running any existing software without needing the source code. BrowserPod on the other hand runs WebAssembly binaries at almost native speed. Source code is required, but that is a fair compromise in the world o…

> WebVM uses x86 virtualization and hence has a significant performance penalty

That is precisely the reason why we chose not avoid using any solution which uses virtualization, even though you get a full OS. QuickJS also pays a performance tax (no JIT) and still doesn't give you the OS.

On our part we're mostly focused on JS for the time being and we think that the best bet is to reuse the browser V8 engine

Re: Running Python code in a sandbox with MicroPython and WASM

#45

Post by binsquare »

simonw wrote: post #31
binsquare wrote: post #28

I build a lightweight vm here that fits your needs as well: https://github.com/smol-machines/smolvm

The thing that's missing is Windows support and the ability to get everything I need for it in a Python program by "pip install X" for something that includes relevant binaries as well as Python code.

It actually supports wsl(windows) and has the ability to persist binaries.

Re: Running Python code in a sandbox with MicroPython and WASM

#46

Post by dylan-sutton »

fzysingularity wrote: post #34
simonw wrote: post #27

Earlier quoted context omitted.

Ok that looks promising! I like that it's built for WASM, and the docs mention wasmtime here: https://edgepython.com/getting-started/what-it-is

Kind of crazy how many bespoke python sandbox implementations have popped up in the past few months. I’d love to see if we can get GPU access within these runtimes, that’d be awesome.

Hey, I'm Dylan. Creator of Edge Python, currently I'm working with burn.dev framework and Web GPU to embed a ML framework bia Edge Python directly in the browser suing the GPU as you said!

I'd be happy if you could try it when it's finished :).

Post reply on HN