🔒 Safe Python in a Sandbox#
Need to run Python code without it having access to files, the network, or system resources? Now it’s possible thanks to MicroPython compiled to WebAssembly.
🤔 Why Do You Need a Sandbox?#
Plugins and dynamic code execution are extremely useful but unsafe if not isolated. Imagine running a plugin that:
- Reads private files
- Makes unauthorized network calls
- Consumes all your CPU or memory
A sandbox prevents all of this.
🏗️ How Does It Work?#
MicroPython (a “lean” version of Python 3 for embedded systems) compiles to WebAssembly. WASM engines like wasmtime provide:
✅ Memory control: strict limits ✅ CPU control: via wasmtime’s “fuel” concept ✅ File control: access only to what you permit ✅ Network control: no communication without your mediation ✅ Host functions: selectively expose system APIs
💡 Explanation in a nutshell#
WebAssembly is a binary format that acts as a “portable virtual machine.” Browsers use it to run compiled JavaScript code safely. By compiling MicroPython to WebAssembly, you get a Python interpreter running in a completely isolated environment: it cannot access your disk, connect to the internet, or consume resources without limits.
In practice, you can now do:
with MicroPythonSession() as session:
session.run("x = 10")
session.run("print(x * 2)")And it all happens in a secure sandbox, even if the code is malicious.
🚀 Real-World Use Case#
Simon Willison uses it for Datasette Agent — enabling safe execution of Python plugins without risking breaking the main application.
More information at the link 👇
