I know that one can not securely restrict normal CPython's capabilities to properly run foreign code without allowing it to access some builtins like open() or allowing other kinds of I/O.

So I researched more and found the alternative interpreters PyPy (written in Python) and Jython (written in Java). Which of those is easier to use for sandboxing user scripts that must interact with the core application?

Here's a short description of what my program should do and what is important for me:

The program will be a multiplayer game that may be run on any PC as server and which allows any number of clients to connect locally or over the network. The game is a round-based normal strategy (mine resources, develop a strong base, conquer territories, eliminate enemies) game, but units should not be controlled directly via mouse/keyboard, but only through Python scripts and commands which the players may upload to the server and that are run each round to determine the actions. The idea for this project comes from http://screeps.com, but I would not like to make an exact clone but just something similar...

Important points are:

  • secure sandboxing of the user scripts. I want that the users should write a class derived from a given subclass which has functions to access the game core. There should be no chance to perform any I/O or system access other than through those methods. Imports must be restricted to tools like string and math only, no possibly dangerous stuff like os or subprocess.
  • good support for real multi-threading, as I should run as many user scripts in parallel as possible to keep the round durations short.
  • The interpreter should be fast and lightweight enough to handle quite a few clients in parallel. I also need an efficient database access with intelligent caching (probably have to code that myself?) that speeds up the data access times without flooding the RAM.

I also know Java fairly well, so I could possibly also write parts of the game core in Java if that could speed things up or make them more secure, but I want the user scripts to be in Python 3.

So again, which Python interpreter would be most suitable for this task? What (dis)advantages does each one have with respect to the listed requirements?

  • May I ask the downvoter to explain his vote and help me to improve the question? Thanks. – Byte Commander Feb 29 '16 at 9:28
  • @Tibo I don't understand your critique. First, I am a person who does not want to pay. Second, I like coding. Third, I am not exactly cloning them, but trying to make my own game derived from their idea. It will use a different language for the scripts and I hope to be able to add more features and customize it as soon as I have a working core. Fourth, it's a great chance to dive even deeper into Python and maybe also Java and to gain more experience with different situations. And fifth, I am looking for a free time project currently anyway and this sounded interesting. – Byte Commander Feb 29 '16 at 9:47
  • 2
    software recommendations are explicitly off-topic per help center (it's the same here as at Stack Overflow). See meta.programmers.stackexchange.com/questions/6483/… – gnat Feb 29 '16 at 9:57
  • 1
    @gnat Okay, but that's not broadly asking "how do I run insecure code", but "which of PyPy and Jython are better suited for that task with respect to that list of other requirements". One can surely write a good and facts-based answer on that, outlining each interpreter's (dis)advantages in those categories and drawing a conclusion from that. That is, if this one isn't busy finding close reasons... – Byte Commander Feb 29 '16 at 10:11
  • 1
    @biziclop Thanks for the first constructive comment to this question! :) – Byte Commander Feb 29 '16 at 11:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.