How to create a sandbox to run untrusted code/modules?

Why not let them run an embedded language, like LUA?

FWIW I stopped researching exbox because the people interested it gave up on in-language sandboxes for their project and switched to Docker to run untrusted code.

I’m currently the impression this could/should be done by limiting the available functions at compile time and would require modifying the elixir compiler to restrict specific modules.

The only sure of way running untrusted code seems to be using docker.

you can construct function calls dynamically at runtime. i don’t think it’s possible to sandbox elixir/erlang code without modifying the vm

There are extremely many ways to call a function - in a lot of places you can pass {module, function, arguments} tuples, you can create atoms at runtime in many ways as well. I don’t see a viable way of filtering this.

OS-process-level sandboxing is definitely a much better idea.

I know i am a Cassandra at that point and that i mess a bit with the whole fun thing.

But Docker is not a sandbox. Is it better than the BEAM isolation ? Yes probably. But if you need a secure sandbox with Docker, the advise right now and for the year to come probably is to have one VM per Docker container. If you want a more secure sandbox/container, have a look at FreeBSD Jails or SmartOS Zones. You can run a Docker container on SmartOS Zones.

Exactly this! Docker is NOT a sandbox, it is pretty trivial to ‘break out of it’, and it is designed for process segmentation, not sandboxing, and the developers are upfront about that. Anyone using docker to sandbox has a ticking time-bomb…

SmartOS Zones would be a good sandbox though. FreeBSD Jails, they ‘mostly’ work, but they can be broken out of with relative ease now too. I’d still say just support lua or something, not elixir.

I’ve found another thread discussing sandboxing here:

Also, found one elixir lua impementation (not sure if this is sandboxed though):
https://github.com/bendiken/exlua

There are a lot of LUA implementations for the BEAM:

• GitHub - rvirding/luerl: Lua in Erlang · GitHub by the very own RVirding, this is implemented in erlang, not super fast, but very safe, it implements ‘most’ of lua, good enough for simple scripting. However you can implement lua things in erlang/elixir that can be called from lua very fast, so it makes a great simple scripting layer.

• GitHub - dryex/exlua: Lua for Elixir. · GitHub is just an Elixir wrapper of luerl to change the API a bit, does not add anything though.

• GitHub - Eonblast/Erlualib: An Erlang linked-in driver that allows embedding Lua into the Erlang VM · GitHub Embedded driver to add lua to the BEAM, full power and normal lua speed, but you can crash the VM if lua crashes (rare, but possible). ^.^

• Do it yourself via a port: This is probably what you should do, make your own C LUA Port system (and release it as a hex.pm library!) that connects to the BEAM via a Port, full safety, full sandbox (as long as you leave out the lua standard library like filesystem and network I/O), etc…

EDIT: It would be fun to build a new simple safe scripting language on Elixir though, not hard to do. ^.^