benno128

Yeah for sure: run it inside a virtual machine, or do some sort of docker magic.

You kind of need to pretend you are a whole computer for a programming language to be happy. There's built in assumptions they're running on a "real" computer. They assume they've got full access to network and disk. Installing packages often requires compiling C extensions, or running native binaries. All that stuff means the best way to sandbox is to virtualise a whole computer.

It's fun to do it with WebAssembly though, you get a lot of guarantees and it's quite light weight.

I've got one that uses WebAssembly to run Python, Ruby, C/C++, JS: https://runno.dev/articles/sandbox/

Thanks! Yeah I'm very aware of Pyodide and interested in adopting some of their techniques.

A big difference between my approach and their approach is that Runno is generic across programming languages. Pyodide only works for Python (and can only work for Python).

Big interesting development in this space is the announcement of Endor at WASM IO which I'd like to try out: https://endor.dev/

Working on Runno (https://runno.dev/) as a side project. It's a tool for running code in the browser for educational use.

[Edit]: I wrote a re-introduction to Runno: The WebComponent for Code over the weekend (https://runno.dev/articles/web-component/)

I've been playing around with turning it into a sandbox for running code in Python (https://runno.dev/articles/sandbox-python/). This would allow you to safely execute AI generated code.

Generally thinking about more ways to run code in sandbox environments, as I think this will become more important as we are generating a lot of "untrusted" code using Gen AI.

Sounds really interesting. Where can I try it out? I struggled to find a link in the article.

Really impressed by the depth and breadth of this project, well done!

A particularly interesting part is the socket layer inside the browser. Other people solving this problem have previously used a proxy to a server that does the real socket implementation. This means you can't have a "browser-only" solution.

The author has solved this (for HTTP/S only) by proxying HTTP requests and then re-creating them as fetch requests (details here: https://github.com/ktock/container2wasm/tree/main/examples/n...). I'm very interested in using this approach for my own project Runno (https://runno.dev).

This is the use case I've been tackling with Runno (https://runno.dev), it's more performant than OP's approach but not as flexible.

There is support in Docker to run wasm-wasi binaries directly (see: https://wasmlabs.dev/articles/docker-without-containers/). The downside compared to OP's approach is that whatever you're running has to have already been compiled to wasm-wasi. The upside would be much faster execution time (no emulation overhead for x86).

I'm working on this problem as well and would be happy to sling you some thoughts and notes. Check my website https://runno.dev and send an email to the address on that website!

Snapshot Preview 1 is the standard all tools are building to right now. The specification is available here: https://github.com/WebAssembly/WASI/blob/main/legacy/preview...

It's pretty unreadable though!

Preview 2 looks like it will be a big change, and is just being finalised at the moment. I'd expect that when preview 2 is available there will be an improvement in the quality of documentation. I'm not sure how long it will take after release for tools to start switching to it. I'd expect Preview 1 will still be the main target at least for the rest of this year.

Yeah of course! They've got STDIN/STDOUT/STDERR and I've built a Virtual Filesystem. But if you're using WASI binaries locally they don't have that restriction.

You might be interested in WAGI: https://github.com/deislabs/wagi

And to catch up on WASI: https://xeiaso.net/talks/unix-philosophy-logical-extreme-was...

Thanks for the feedback! It’s also cost me about $15 so far. I don’t think I’ll do that again, but it was fun as a demo!

SPA sense. It’s cobbled together because I just have fun with it. Not sure why it’s temperamental, haven’t bothered investigating.

I wouldn't put it in prod, but it would be possible. You'd need a JS binding layer that dealt with the output and wrote it to the page, but it could be minimal.

There are other projects that are targeted more at this kind of thing if you want dynamic access to the DOM from Web Assembly (sorry I don't know them off the top of my head).

Might be this particular build of Python, or might be that I implemented one of the `fd` functions in a way Python/SQlite is surprised by. I'll have a look into it some time!

Thanks! Yeah WebAssembly has an exciting future ahead of it.

Looking forward to it!

You just need to create the file first!

    >>> open("data.db", "w+").close()
    >>> db = sqlite3.connect("/data.db")
    >>> db
    <sqlite3.Connection object at 0x8b3fd8>

Sorry! It is running ffmpeg in your browser on page load, which might not make it happy.

Is this on the blog post, or are you trying it out yourself?

If it's on the blog post, it sounds like your browser doesn't support `SharedArrayBuffer` (https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...) or you've disabled Cross Origin Isolation somehow. It might be because you have an old browser (there was a period where it was disabled) or you have disabled Cross Origin Isolation yourself (maybe a security setting?).

Sorry! Sometimes web is hard.

It's a bit temperamental on some browsers sorry (I've seen it fail on Arc). I implemented my own front-end router and I have done a bad job. I've seen it work today on Chrome, Firefox and Safari.

Haha thanks, you too!

G’day, if anyone has any questions about this I’m happy to answer them here.

Thanks!

If you’ve got a way to add node packages to your frontend then it is pretty straightforward. If not, using unpkg (https://unpkg.com/) in a script tag should work.

Happy to help you figure it out! Post in the discussion board on GitHub or email me (address on the website).

I have a project that does this: https://runno.dev

No shared state between elements, but it’s an interesting idea.

Edit: It runs other languages as well, like Python, C, Ruby.

This is just plain wrong. Web Components work in every browser that matters. They are standard DOM elements and can be written in plain HTML server-side or via legacy front-end libraries.

I'm using web components in production to help interoperability between 2012 era Handlebars/jQuery/Backbone and modern tools like React and Prosemirror.

I think framing it this way can lead to real gripes with the interface. Web Components are a great way to build individual components that can be reused across an app, website, or shared as part of a library. They are like helper functions for HTML.

They don't work as well for building apps, sure you can do it, but tools like React/Vue/Svelte are much better at building a whole app experience. Particularly when you consider meta-frameworks and the ecosystem around them.

I’ve been using lit in side projects (e.g. runno.dev) and really enjoyed it. Just like any framework it can be a bit confusing learning the primitives but I’ve found it as productive as React, Vue or Svelte.

The thing I like most about lit is that it embraces web standards. Sometimes that means the ergonomics are a bit strange. But it also means it gets performance benefits, and interoperability bonuses. Plus it feels like you’re learning something about the underlying platform while you’re using it.

The best example is that it uses reactive data binding via attributes for passing data down the tree, and native DOM events for passing data up the tree. That allows you all the same safety that a framework like React offers, but also means your component can be used by any other framework, or by vanilla JS (because they all support the DOM).

Big fan of the sizzle. Its nice to get a real persons quick short take of the tech news, rather than having to read every long winded press release rewritten as news - or worse - drinking from the firehose on twitter.