4 added 77 characters in body
source | link

I know that one can not securely restrict normal CPython's capabilities to properly run foreign code without allowing it to access some builtins like open() or allowing other kinds of I/O.

So I researched more and found the alternative interpreters PyPy (written in Python) and Jython (written in Java). Which of those is easier to use for sandboxing user scripts that must interact with the core application?


Here's a short description of what my program should do and what is important for me:

The program will be a multiplayer game that may be run on any PC as server and which allows any number of clients to connect locally or over the network. The game is a round-based normal strategy (mine resources, develop a strong base, conquer territories, eliminate enemies) game, but units should not be controlled directly via mouse/keyboard, but only through Python scripts and commands which the players may upload to the server and that are run each round to determine the actions. The templateidea for this project iscomes from http://screeps.com, but I would not like to make an exact clone but just something similar.  ..

Important points are:

  • secure sandboxing of the user scripts. I want that the users should write a class derived from a given subclass which has functions to access the game core. There should be no chance to perform any I/O or system access other than through those methods. Imports must be restricted to tools like string and math only, no possibly dangerous stuff like os or subprocess.
  • good support for real multi-threading, as I should run as many user scripts in parallel as possible to keep the round durations short.
  • The interpreter should be fast and lightweight enough to handle quite a few clients in parallel. I also need an efficient database access with intelligent caching (probably have to code that myself?) that speeds up the data access times without flooding the RAM.

I also know Java fairly well, so I could possibly also write parts of the game core in Java if that could speed things up or make them more secure, but I want the user scripts to be in Python 3.


So again, which Python interpreter would be most suitable for this task? What (dis)advantages does each one have with respect to the listed requirements?

I know that one can not securely restrict normal CPython's capabilities to properly run foreign code without allowing it to access some builtins like open() or allowing other kinds of I/O.

So I researched more and found the alternative interpreters PyPy (written in Python) and Jython (written in Java). Which of those is easier to use for sandboxing user scripts that must interact with the core application?


Here's a short description of what my program should do and what is important for me:

The program will be a multiplayer game that may be run on any PC as server and which allows any number of clients to connect locally or over the network. The game is a round-based normal strategy (mine resources, develop a strong base, conquer territories, eliminate enemies) game, but units should not be controlled directly via mouse/keyboard, but only through Python scripts and commands which the players may upload to the server and that are run each round to determine the actions. The template for this project is http://screeps.com.  

Important points are:

  • secure sandboxing of the user scripts. I want that the users should write a class derived from a given subclass which has functions to access the game core. There should be no chance to perform any I/O or system access other than through those methods. Imports must be restricted to tools like string and math only, no possibly dangerous stuff like os or subprocess.
  • good support for real multi-threading, as I should run as many user scripts in parallel as possible to keep the round durations short.
  • The interpreter should be fast and lightweight enough to handle quite a few clients in parallel. I also need an efficient database access with intelligent caching (probably have to code that myself?) that speeds up the data access times without flooding the RAM.

I also know Java fairly well, so I could possibly also write parts of the game core in Java if that could speed things up or make them more secure, but I want the user scripts to be in Python 3.


So again, which Python interpreter would be most suitable for this task? What (dis)advantages does each one have with respect to the listed requirements?

I know that one can not securely restrict normal CPython's capabilities to properly run foreign code without allowing it to access some builtins like open() or allowing other kinds of I/O.

So I researched more and found the alternative interpreters PyPy (written in Python) and Jython (written in Java). Which of those is easier to use for sandboxing user scripts that must interact with the core application?


Here's a short description of what my program should do and what is important for me:

The program will be a multiplayer game that may be run on any PC as server and which allows any number of clients to connect locally or over the network. The game is a round-based normal strategy (mine resources, develop a strong base, conquer territories, eliminate enemies) game, but units should not be controlled directly via mouse/keyboard, but only through Python scripts and commands which the players may upload to the server and that are run each round to determine the actions. The idea for this project comes from http://screeps.com, but I would not like to make an exact clone but just something similar...

Important points are:

  • secure sandboxing of the user scripts. I want that the users should write a class derived from a given subclass which has functions to access the game core. There should be no chance to perform any I/O or system access other than through those methods. Imports must be restricted to tools like string and math only, no possibly dangerous stuff like os or subprocess.
  • good support for real multi-threading, as I should run as many user scripts in parallel as possible to keep the round durations short.
  • The interpreter should be fast and lightweight enough to handle quite a few clients in parallel. I also need an efficient database access with intelligent caching (probably have to code that myself?) that speeds up the data access times without flooding the RAM.

I also know Java fairly well, so I could possibly also write parts of the game core in Java if that could speed things up or make them more secure, but I want the user scripts to be in Python 3.


So again, which Python interpreter would be most suitable for this task? What (dis)advantages does each one have with respect to the listed requirements?

3 deleted 20 characters in body
source | link

I know that one can not securely restrict normal CPython's capabilities to properly run foreign code without allowing it to access some builtins like open() or allowing other kinds of I/O.

So I researched more and found the alternative interpreters PyPy (written in Python) and Jython (written in Java). Which of those (or even any other) is easier to use for sandboxing user scripts that must interact with the core application?


Here's a short description of what my program should do and what is important for me:

The program will be a multiplayer game that may be run on any PC as server and which allows any number of clients to connect locally or over the network. The game is a round-based normal strategy (mine resources, develop a strong base, conquer territories, eliminate enemies) game, but units should not be controlled directly via mouse/keyboard, but only through Python scripts and commands which the players may upload to the server and that are run each round to determine the actions. The template for this project is http://screeps.com.

Important points are:

  • secure sandboxing of the user scripts. I want that the users should write a class derived from a given subclass which has functions to access the game core. There should be no chance to perform any I/O or system access other than through those methods. Imports must be restricted to tools like string and math only, no possibly dangerous stuff like os or subprocess.
  • good support for real multi-threading, as I should run as many user scripts in parallel as possible to keep the round durations short.
  • The interpreter should be fast and lightweight enough to handle quite a few clients in parallel. I also need an efficient database access with intelligent caching (probably have to code that myself?) that speeds up the data access times without flooding the RAM.

I also know Java fairly well, so I could possibly also write parts of the game core in Java if that could speed things up or make them more secure, but I want the user scripts to be in Python 3.


So again, which Python interpreter would be most suitable for this task? What (dis)advantages does each one have with respect to the listed requirements?

I know that one can not securely restrict normal CPython's capabilities to properly run foreign code without allowing it to access some builtins like open() or allowing other kinds of I/O.

So I researched more and found the alternative interpreters PyPy (written in Python) and Jython (written in Java). Which of those (or even any other) is easier to use for sandboxing user scripts that must interact with the core application?


Here's a short description of what my program should do and what is important for me:

The program will be a multiplayer game that may be run on any PC as server and which allows any number of clients to connect locally or over the network. The game is a round-based normal strategy (mine resources, develop a strong base, conquer territories, eliminate enemies) game, but units should not be controlled directly via mouse/keyboard, but only through Python scripts and commands which the players may upload to the server and that are run each round to determine the actions. The template for this project is http://screeps.com.

Important points are:

  • secure sandboxing of the user scripts. I want that the users should write a class derived from a given subclass which has functions to access the game core. There should be no chance to perform any I/O or system access other than through those methods. Imports must be restricted to tools like string and math only, no possibly dangerous stuff like os or subprocess.
  • good support for real multi-threading, as I should run as many user scripts in parallel as possible to keep the round durations short.
  • The interpreter should be fast and lightweight enough to handle quite a few clients in parallel. I also need an efficient database access with intelligent caching (probably have to code that myself?) that speeds up the data access times without flooding the RAM.

I also know Java fairly well, so I could possibly also write parts of the game core in Java if that could speed things up or make them more secure, but I want the user scripts to be in Python 3.


So again, which Python interpreter would be most suitable for this task? What (dis)advantages does each one have with respect to the listed requirements?

I know that one can not securely restrict normal CPython's capabilities to properly run foreign code without allowing it to access some builtins like open() or allowing other kinds of I/O.

So I researched more and found the alternative interpreters PyPy (written in Python) and Jython (written in Java). Which of those is easier to use for sandboxing user scripts that must interact with the core application?


Here's a short description of what my program should do and what is important for me:

The program will be a multiplayer game that may be run on any PC as server and which allows any number of clients to connect locally or over the network. The game is a round-based normal strategy (mine resources, develop a strong base, conquer territories, eliminate enemies) game, but units should not be controlled directly via mouse/keyboard, but only through Python scripts and commands which the players may upload to the server and that are run each round to determine the actions. The template for this project is http://screeps.com.

Important points are:

  • secure sandboxing of the user scripts. I want that the users should write a class derived from a given subclass which has functions to access the game core. There should be no chance to perform any I/O or system access other than through those methods. Imports must be restricted to tools like string and math only, no possibly dangerous stuff like os or subprocess.
  • good support for real multi-threading, as I should run as many user scripts in parallel as possible to keep the round durations short.
  • The interpreter should be fast and lightweight enough to handle quite a few clients in parallel. I also need an efficient database access with intelligent caching (probably have to code that myself?) that speeds up the data access times without flooding the RAM.

I also know Java fairly well, so I could possibly also write parts of the game core in Java if that could speed things up or make them more secure, but I want the user scripts to be in Python 3.


So again, which Python interpreter would be most suitable for this task? What (dis)advantages does each one have with respect to the listed requirements?

2 edited title
| link

Run Does PyPy or Jython run untrusted Python 3 code - recommended interpretermore secure while still being fast?

1
source | link