A Python Sandbox for Dynamic Rule Execution
summary
A customized Python sandbox implements resource.setrlimit to cap CPU, memory and file usage, uses ast static analysis plus a module/function blocklist to catch malicious patterns before execution, and enforces syscall and timeout limits at runtime. Per‑rule resource profiles allow dynamic allocation. An interpreter pool with preloaded common libraries eliminates per‑request import overhead, solving the observed degradation where 20–30 req/s causes disk IO saturation and latency rising from milliseconds to hundreds or seconds, and it restores sub‑millisecond rule execution.
AI-written summary · about
chapters (7)
related talks
36mSandboxing Ruby: The Good, the Bad, and the Fugly
20mSecimport: Tailor-Made eBPF Sandbox for Python Applications
37mSandboxing Applications with Landlock
32mLLMs Behind Bars: Sandboxes at Scale for AI on a Short Leash
30mSandboxing Agentic AI With LSM-BPF
44mSlime: Automated Anti-Sandboxing Disarmament System
01h 25mSandboxing a Linux Application
38mSandboxing in Linux with zero lines of code