RodolfoSilva
Hi everyone, I’m developing a project where I will allow users to dynamically edit and execute code. I was wondering if there is any way to limit what the user can do and access. Something like livebook do.
At the moment, the basic implementation I’m using is this:
code = "\"Hello \#{input}\""
quoted = Code.string_to_quoted!(code)
env = Code.env_for_eval([])
binding = [input: "Name"]
{value, _binding, _env} = Code.eval_quoted_with_env(quoted, binding, env, prune_binding: true)
IO.puts(value)
For example, I don’t want users to have access to my application’s modules as Ecto. I need a way to limit the user’s environment and allow him to install dependencies and use only the library installed by him.
Where Next?
Trending in Questions
Other Trending Topics
Latest Phoenix Threads
Latest on Elixir Forum
Sponsor Spotlight
Phoenix, LiveView, multimedia pipelines, distributed systems. 400 engineers, Elixir since 2017. Available for hire.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #library
- #deployment
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #podcasts
- #javascript
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ai
- #ecto-query
- #elixirconf-us
- #blog-post
- #elixir-ls
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #elixirconf-eu
- #api
- #forms
- #security
- #metaprogramming
Our Sponsors
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Elixir, Erlang & BEAM conferences from Code Sync - join us in 2026!
Master modern tools, write cleaner code, and tackle real-world challenges.
Bringing learning, work and compliance together since 1987.
Producing high quality Elixir screencasts since 2017.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 1 to 3- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
zachallaun
I don’t believe
Codehas utilities for running things in a sandbox.I’m not an expert in this, but I believe the best practice for these sorts of things is to run the code in a fully sandboxed environment, e.g. a container that you can spin up explicitly for this purpose that is configured with limited resources, no Internet connection, etc.
D4no0
If you need only templating, I would strongly recommend using a templating engine (like mustache), as code generation at runtime is dangerous (access to the system is not the only danger) , there are few other solutions if you need code though:
RodolfoSilva
A ideia é construir algo como o Livebook, para gerar fluxos de trabalho para rodar dentro da empresa, mas a ideia principal é transformar isso em um projeto OpenSource.
Seria uma alternativa ao Zapier, n8n, node-red.
I already start the project:
@josevalim do you have any suggestion?