Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> smolagents does code execution, which means "danger for your machine" if ran locally. We've railguardeed that a bit with our custom python interpreter, but it will never be 100% safe, so we're enabling remote execution with E2B and soon Docker.

Those remote interfaces may also work with local VMs for isolation.



Yeah, that's what I was thinking: just throw the whole lot inside a Docker container and call it a day. Unless you're dealing with potentially malicious code that could break out of a container, that should isolate the rest of your machine sufficiently.

Alternatively, PyPy is actually fully sandboxable.

On Linux, you can also use `seccomp.` See, for instance, https://healeycodes.com/running-untrusted-python-code




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: