Looking for thoughts on using Lua for allowing backend scripting

I think that you should consider using Dune with a separate node setup. For example, you can start a separate node where the user scripts are running and these scripts will communicate with main node through some API (REST or maybe just some erlang terms over TCP/socket)

Thanks for the reply! I’m aware of Dune but the idea is to have a more general scripting language for use in a hypothetical product used by mere mortals who would be offended by having to learn a valuable skill like Elixir or FP

Dave Lucia has talked about extensively using luerl for his product at tvlabs.ai to enable customer scripting. I was present for the codeBEAM talk given by Dave and Robert and the approach is compelling. My takeaway is that it is a good solution.

That makes sense since Dave Lucia is the author of Lua (the package). Thanks! Unfortunately the talk doesn’t seem to be on YouTube, but I’m still looking there. There is one by Robert about luerl which I’m about to watch. Thanks!

Latest elixirpodcast talked about a company making a safe ast thing that let them let people write elixir without fear of getting pwned.

I am not sure I would trust that myself tbf, but I think they have published some of that as open source.

However a key takeaway they mentioned in the podcast was that in their benchmarking of homegrown vs luerl vs deno etc lurerl was really fast, just a little behind homegrown thing.

We are talking microseconds here. That means that luerl will often be done executing before you have even transmitted the payload to the executor over tcp when using something like Dune or Deno.

Its also extremely simple to expose functions from your codebase to luerl.

And as Dave has said at a few conferences now, lua is a very good LLM target because its so simple grammar and logic. Meaning you can probably make great helpers if you have users who are only partial programmers.

The talk is codebeam berlin last year about tvlabs. I dont think luerl or lua was in the title.

Ah thank you, found it!

And thanks, that’s all good info! I should have mentioned that I played with Lua (the package) a bunch before posting and yes, it’s reallllllly easy to pass variables and functions to scripts, sandbox, and call Lua in Elixir—it’s great!

I guess another thing I’m curious about is sandboxing in general. I’ve read how to do it (and Lua.ex does it out of the box) but have read several murmurings that it’s not perfect, or at least hard to get totally right. Of course none of these posts expand on that, so I’m trying to discover those kinds of pitfalls.

I think there is academic proof that luerl is unpwnable? I feel that was mentioned somewhere

I’ll seek that out, thank you!

One thing to be on the lookout for luerl’s max_reductions and max_time options. Not only do you want to sandbox certain capabilities, but you likely want to protect against infinite loops and unbounded memory growth, or any other resources that could be exploited.

https://github.com/rvirding/luerl/blob/076510701bd0f1f1bde9c49f5ccde0701be88d49/doc/luerl_sandbox.txt#L51

Have fun, I personally love luerl, big fan