No,no, Docker is not a sandbox for untrusted code.

I’ve been building on that foundation: script runs in sandbox, all commands and file writes get captured, human-in-the-loop reviews the diff before anything executes. It’s not adversarial (block/contain) but collaborative (show intent, ask permission).

Different tradeoff than WASM or containers: lighter than VMs, cross-platform, and the user sees exactly what the agent wants to do before approving.

WIP, currently porting to PyPy 3.8 to unlock MacOS arm64 support: https://github.com/corv89/shannot

    @task(name="analyze_data", compute="MEDIUM", ram="512MB", timeout="30s", max_retries=1)
    def analyze_data(dataset: list) -> dict:
        # Your code runs safely in a Wasm sandbox
        return {"processed": len(dataset), "status": "complete"}

Even defining semantics seems awkward, especially if one wants those semantics to simultaneously make sense and have any sort of clear security properties.

edit: a quick look at the source suggests that the output is deserialized JSON regardless of what the type signature says. That’s certainly one solution.

Long, long ago, there was "repy"[1][2]. (This is definitely included in the "none succeeded" bucket, FWIW.)

[1]: https://github.com/SeattleTestbed/repy_v2

[2]: https://dl.acm.org/doi/10.1145/1866307.1866332

I have been looking towards some kind of quick-start qemu option as a possibility, but the project will take a while.

[1] https://github.com/mavdol/capsule

This is so true

https://judge0.com/

How does it work? Which WASM euntime does it use? Does it use a Python jnterpreter compiled to WASM?

---

That is not save at all. You could always hijack builtin functions within untrusted code.

  def untrusted_function():
      original_map = map
  
      def noisy_map(func, *iterables):
          print(f"--- Log: map() called on {func.__name__} ---")
          return original_map(func, *iterables)
  
      globals()['map'] = noisy_map