healeycodes / untrusted-python

📦 Run untrusted python code on the server.

📦 untrusted-python

My blog post: Running Untrusted Python Code

This is a sandbox for running untrusted Python code. Until it's been audited by someone with some kind of security authority, you should consider it to be insecure.

With that in mind, I welcome any bug reports, sandbox escapes, etc. – please raise an issue or email/DM me.

You can try and break out of it here: https://untrusted-python.vercel.app

Development

Fly.io backend

Install flyctl.

cd sandbox
fly launch

Follow the instructions in your terminal. Make a note of the URL – it will look like https://foo.fly.dev. Copy it (without a trailing slash), and add it to web/.env as API.

Next.js frontend

npm i
npm run dev

Follow the instructions in your terminal.

Deploy

web is a Next.js app that you can deploy to Vercel. Set the root directory of the project to web.

sandbox is a Fly.io app that has fly.toml file ready to use. Add the Fly.io URL as a Vercel environment variable as API (without a trailing slash).